From e922d1eaa3774a68c96eae01e0fd08f8a30cda8c Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Fri, 10 Nov 2023 11:37:27 +0000 Subject: [PATCH] Add ability to change linker warning messages into errors when reporting executable stacks and/or executable segments. include * bfdlink.h (struct bfd_link_info): Update descriptions of the 'execstack', 'noexecstack' and 'warn_execstack' fields. Add 'error_exectack' and 'warn_is_error_for_rwx_segments' fields. bfd * elf.c (assign_file_positions_except_relocs): Turn warnings about executable segments into errors if so requested. * elflink.c (bfd_elf_size_dynamic_sections): Turn warnings about executable stacks into errors if so requested. ld * ldlex.h (enum option_values): Add OPTION_ERROR_EXECSTACK, OPTION_NO_ERROR_EXECSTACK, OPTION_WARN_EXECSTACK_OBJECTS, OPTION_ERROR_RWX_SEGMENTS and OPTION_NO_ERROR_RWX_SEGMENTS. (struct ld_option): Add new long options. (parse_args): Parse new long options. (elf_static_list_options): Display the new options. * ld.texi: Document the new command line options. * configure.ac (error-execstack): New configuration option. (error-rwx-segments): New configuration option. * emultempl/elf.em (_before_parse): Initialse the new linkinfo fields. * NEWS: Mention the new features. * config.in: Regenerate. * configure: Regenerate. * testsuite/ld-elf/commonpage2.d: Disable errors for RWX segments and/or executable stacks. * testsuite/ld-elf/elf.exp: Likewise. * testsuite/ld-elf/header.d: Likewise. * testsuite/ld-elf/loadaddr1.d: Likewise. * testsuite/ld-elf/loadaddr2.d: Likewise. * testsuite/ld-elf/maxpage4.d: Likewise. * testsuite/ld-elf/nobits-1.d: Likewise. * testsuite/ld-elf/note-1.d: Likewise. * testsuite/ld-elf/orphan-10.d: Likewise. * testsuite/ld-elf/orphan-11.d: Likewise. * testsuite/ld-elf/orphan-12.d: Likewise. * testsuite/ld-elf/orphan-5.d: Likewise. * testsuite/ld-elf/orphan-7.d: Likewise. * testsuite/ld-elf/orphan-8.d: Likewise. * testsuite/ld-elf/orphan-9.d: Likewise. * testsuite/ld-elf/orphan-region.d: Likewise. * testsuite/ld-elf/orphan.d: Likewise. * testsuite/ld-elf/pr19539.d: Likewise. * testsuite/ld-elf/pr26256-1a.d: Likewise. * testsuite/ld-elf/pr26907.d: Likewise. * testsuite/ld-elf/pr28597.d: Likewise. * testsuite/ld-elf/retain2.d: Likewise. * testsuite/ld-elf/shared.exp: Likewise. * testsuite/ld-elf/size-1.d: Likewise. * testsuite/ld-elf/textaddr7.d: Likewise. * testsuite/ld-elf/warn1.d: Likewise. * testsuite/ld-elf/warn2.d: Likewise. * testsuite/ld-i386/discarded1.d: Likewise. * testsuite/ld-i386/pr19175.d: Likewise. * testsuite/ld-i386/pr19539.d: Likewise. * testsuite/ld-i386/pr23189.d: Likewise. * testsuite/ld-plugin/lto-3r.d: Likewise. * testsuite/ld-plugin/lto-5r.d: Likewise. * testsuite/ld-plugin/lto.exp: Likewise. * testsuite/ld-powerpc/ppc476-shared.d: Likewise. * testsuite/ld-powerpc/ppc476-shared2.d: Likewise. * testsuite/ld-powerpc/pr28827-2.d: Likewise. * testsuite/ld-s390/s390.exp: Likewise. * testsuite/ld-scripts/align2a.d: Likewise. * testsuite/ld-scripts/align2b.d: Likewise. * testsuite/ld-scripts/align5.d: Likewise. * testsuite/ld-scripts/alignof.exp: Likewise. * testsuite/ld-scripts/crossref.exp: Likewise. * testsuite/ld-scripts/defined2.d: Likewise. * testsuite/ld-scripts/defined3.d: Likewise. * testsuite/ld-scripts/defined5.d: Likewise. * testsuite/ld-scripts/pr14962.d: Likewise. * testsuite/ld-scripts/pr18963.d: Likewise. * testsuite/ld-scripts/pr20302.d: Likewise. * testsuite/ld-scripts/print-memory-usage.exp: Likewise. * testsuite/ld-scripts/rgn-at1.d: Likewise. * testsuite/ld-scripts/rgn-at10.d: Likewise. * testsuite/ld-scripts/rgn-at4.d: Likewise. * testsuite/ld-scripts/rgn-at6.d: Likewise. * testsuite/ld-scripts/rgn-at8.d: Likewise. * testsuite/ld-scripts/rgn-at9.d: Likewise. * testsuite/ld-scripts/rgn-over1.d: Likewise. * testsuite/ld-scripts/rgn-over2.d: Likewise. * testsuite/ld-scripts/rgn-over4.d: Likewise. * testsuite/ld-scripts/rgn-over5.d: Likewise. * testsuite/ld-scripts/rgn-over6.d: Likewise. * testsuite/ld-scripts/script.exp: Likewise. * testsuite/ld-scripts/sizeof.exp: Likewise. * testsuite/ld-scripts/sort-file.d: Likewise. * testsuite/ld-x86-64/discarded1.d: Likewise. * testsuite/ld-x86-64/pr19175.d: Likewise. * testsuite/ld-x86-64/pr19539a.d: Likewise. * testsuite/ld-x86-64/pr19539b.d: Likewise. * testsuite/ld-x86-64/pr23189.d: Likewise. --- bfd/ChangeLog | 7 +++ bfd/elf.c | 50 ++++++++++++--- bfd/elflink.c | 35 ++++++++++- include/ChangeLog | 6 ++ include/bfdlink.h | 39 +++++++++--- ld/ChangeLog | 87 ++++++++++++++++++++++++++ ld/NEWS | 9 +++ ld/config.in | 8 +++ ld/configure | 34 ++++++++++ ld/configure.ac | 26 ++++++++ ld/emultempl/elf.em | 2 + ld/ld.texi | 75 ++++++++++++++++------ ld/ldlex.h | 5 ++ ld/lexsup.c | 64 ++++++++++++++++--- ld/testsuite/ld-elf/commonpage2.d | 2 +- ld/testsuite/ld-elf/elf.exp | 14 ++--- ld/testsuite/ld-elf/header.d | 2 +- ld/testsuite/ld-elf/loadaddr1.d | 2 +- ld/testsuite/ld-elf/loadaddr2.d | 2 +- ld/testsuite/ld-elf/maxpage4.d | 2 +- ld/testsuite/ld-elf/nobits-1.d | 2 +- ld/testsuite/ld-elf/note-1.d | 2 +- ld/testsuite/ld-elf/orphan-10.d | 2 +- ld/testsuite/ld-elf/orphan-11.d | 2 +- ld/testsuite/ld-elf/orphan-12.d | 2 +- ld/testsuite/ld-elf/orphan-5.d | 2 +- ld/testsuite/ld-elf/orphan-7.d | 2 +- ld/testsuite/ld-elf/orphan-8.d | 2 +- ld/testsuite/ld-elf/orphan-9.d | 2 +- ld/testsuite/ld-elf/orphan-region.d | 2 +- ld/testsuite/ld-elf/orphan.d | 2 +- ld/testsuite/ld-elf/pr19539.d | 2 +- ld/testsuite/ld-elf/pr26256-1a.d | 2 +- ld/testsuite/ld-elf/pr26907.d | 2 +- ld/testsuite/ld-elf/pr28597.d | 2 +- ld/testsuite/ld-elf/retain2.d | 2 +- ld/testsuite/ld-elf/shared.exp | 12 ++-- ld/testsuite/ld-elf/size-1.d | 2 +- ld/testsuite/ld-elf/textaddr7.d | 2 +- ld/testsuite/ld-elf/warn1.d | 2 +- ld/testsuite/ld-elf/warn2.d | 2 +- ld/testsuite/ld-i386/discarded1.d | 2 +- ld/testsuite/ld-i386/pr19175.d | 2 +- ld/testsuite/ld-i386/pr19539.d | 2 +- ld/testsuite/ld-i386/pr23189.d | 2 +- ld/testsuite/ld-plugin/lto-3r.d | 2 +- ld/testsuite/ld-plugin/lto-5r.d | 2 +- ld/testsuite/ld-plugin/lto.exp | 4 +- ld/testsuite/ld-powerpc/ppc476-shared.d | 2 +- ld/testsuite/ld-powerpc/ppc476-shared2.d | 2 +- ld/testsuite/ld-powerpc/pr28827-2.d | 2 +- ld/testsuite/ld-s390/s390.exp | 2 +- ld/testsuite/ld-scripts/align2a.d | 2 +- ld/testsuite/ld-scripts/align2b.d | 2 +- ld/testsuite/ld-scripts/align5.d | 4 +- ld/testsuite/ld-scripts/alignof.exp | 2 +- ld/testsuite/ld-scripts/crossref.exp | 14 ++--- ld/testsuite/ld-scripts/defined2.d | 2 +- ld/testsuite/ld-scripts/defined3.d | 2 +- ld/testsuite/ld-scripts/defined5.d | 2 +- ld/testsuite/ld-scripts/pr14962.d | 2 +- ld/testsuite/ld-scripts/pr18963.d | 2 +- ld/testsuite/ld-scripts/pr20302.d | 2 +- ld/testsuite/ld-scripts/print-memory-usage.exp | 2 +- ld/testsuite/ld-scripts/rgn-at1.d | 2 +- ld/testsuite/ld-scripts/rgn-at10.d | 2 +- ld/testsuite/ld-scripts/rgn-at4.d | 2 +- ld/testsuite/ld-scripts/rgn-at6.d | 2 +- ld/testsuite/ld-scripts/rgn-at8.d | 2 +- ld/testsuite/ld-scripts/rgn-at9.d | 2 +- ld/testsuite/ld-scripts/rgn-over1.d | 2 +- ld/testsuite/ld-scripts/rgn-over2.d | 2 +- ld/testsuite/ld-scripts/rgn-over4.d | 2 +- ld/testsuite/ld-scripts/rgn-over5.d | 2 +- ld/testsuite/ld-scripts/rgn-over6.d | 2 +- ld/testsuite/ld-scripts/script.exp | 4 +- ld/testsuite/ld-scripts/sizeof.exp | 2 +- ld/testsuite/ld-scripts/sort-file.d | 2 +- ld/testsuite/ld-x86-64/discarded1.d | 2 +- ld/testsuite/ld-x86-64/pr19175.d | 2 +- ld/testsuite/ld-x86-64/pr19539a.d | 2 +- ld/testsuite/ld-x86-64/pr19539b.d | 2 +- ld/testsuite/ld-x86-64/pr23189.d | 2 +- 83 files changed, 488 insertions(+), 137 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 2b12eb35d27..f8086fb843b 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,10 @@ +2023-11-10 Nick Clifton + + * elf.c (assign_file_positions_except_relocs): Turn warnings about + executable segments into errors if so requested. + * elflink.c (bfd_elf_size_dynamic_sections): Turn warnings about + executable stacks into errors if so requested. + 2023-10-30 Nick Clifton * bpf-reloc.def (R_BPF_64_NODLD32): Add entry. diff --git a/bfd/elf.c b/bfd/elf.c index bd2a5e43551..08b6df5503e 100644 --- a/bfd/elf.c +++ b/bfd/elf.c @@ -7010,6 +7010,9 @@ assign_file_positions_except_relocs (bfd *abfd, { if (link_info != NULL && ! link_info->no_warn_rwx_segments) { + bool warned_tls = false; + bool warned_rwx = false; + /* Memory resident segments with non-zero size and RWX permissions are a security risk, so we generate a warning here if we are creating any. */ @@ -7022,16 +7025,47 @@ assign_file_positions_except_relocs (bfd *abfd, if (phdr->p_memsz == 0) continue; - if (phdr->p_type == PT_TLS && (phdr->p_flags & PF_X)) - _bfd_error_handler (_("warning: %pB has a TLS segment" - " with execute permission"), - abfd); - else if (phdr->p_type == PT_LOAD + if (! warned_tls + && phdr->p_type == PT_TLS + && (phdr->p_flags & PF_X)) + { + if (link_info->warn_is_error_for_rwx_segments) + { + _bfd_error_handler (_("\ +error: %pB has a TLS segment with execute permission"), + abfd); + return false; + } + + _bfd_error_handler (_("\ +warning: %pB has a TLS segment with execute permission"), + abfd); + if (warned_rwx) + break; + + warned_tls = true; + } + else if (! warned_rwx + && phdr->p_type == PT_LOAD && ((phdr->p_flags & (PF_R | PF_W | PF_X)) == (PF_R | PF_W | PF_X))) - _bfd_error_handler (_("warning: %pB has a LOAD segment" - " with RWX permissions"), - abfd); + { + if (link_info->warn_is_error_for_rwx_segments) + { + _bfd_error_handler (_("\ +error: %pB has a LOAD segment with RWX permissions"), + abfd); + return false; + } + + _bfd_error_handler (_("\ +warning: %pB has a LOAD segment with RWX permissions"), + abfd); + if (warned_tls) + break; + + warned_rwx = true; + } } } diff --git a/bfd/elflink.c b/bfd/elflink.c index 99f4cdd5527..49ea222ec77 100644 --- a/bfd/elflink.c +++ b/bfd/elflink.c @@ -7152,9 +7152,20 @@ bfd_elf_size_dynamic_sections (bfd *output_bfd, /* If the user has explicitly requested warnings, then generate one even though the choice is the result of another command line option. */ if (info->warn_execstack == 1) - _bfd_error_handler - (_("\ + { + if (info->error_execstack) + { + _bfd_error_handler + (_("\ +error: creating an executable stack because of -z execstack command line option")); + return false; + } + + _bfd_error_handler + (_("\ warning: enabling an executable stack because of -z execstack command line option")); + } + elf_stack_flags (output_bfd) = PF_R | PF_W | PF_X; } else if (info->noexecstack) @@ -7210,11 +7221,29 @@ warning: enabling an executable stack because of -z execstack command line optio being enabled despite the fact that it was not requested on the command line. */ if (noteobj) - _bfd_error_handler (_("\ + { + if (info->error_execstack) + { + _bfd_error_handler (_("\ +error: %s: is triggering the generation of an executable stack (because it has an executable .note.GNU-stack section)"), + bfd_get_filename (noteobj)); + return false; + } + + _bfd_error_handler (_("\ warning: %s: requires executable stack (because the .note.GNU-stack section is executable)"), bfd_get_filename (noteobj)); + } else if (emptyobj) { + if (info->error_execstack) + { + _bfd_error_handler (_("\ +error: %s: is triggering the generation of an executable stack because it does not have a .note.GNU-stack section"), + bfd_get_filename (emptyobj)); + return false; + } + _bfd_error_handler (_("\ warning: %s: missing .note.GNU-stack section implies executable stack"), bfd_get_filename (emptyobj)); diff --git a/include/ChangeLog b/include/ChangeLog index e0f0cb3edf4..7ea77f81693 100644 --- a/include/ChangeLog +++ b/include/ChangeLog @@ -1,3 +1,9 @@ +2023-11-10 Nick Clifton + + * bfdlink.h (struct bfd_link_info): Update descriptions of the + 'execstack', 'noexecstack' and 'warn_execstack' fields. + Add 'error_exectack' and 'warn_is_error_for_rwx_segments' fields. + 2023-10-30 Nick Clifton * elf/bpf.h (R_BPF_64_NODYLD32): Add a note that this reloc is diff --git a/include/bfdlink.h b/include/bfdlink.h index 840790a298c..8882257c632 100644 --- a/include/bfdlink.h +++ b/include/bfdlink.h @@ -484,26 +484,49 @@ struct bfd_link_info --dynamic-list command line options. */ unsigned int dynamic: 1; - /* TRUE if PT_GNU_STACK segment should be created with PF_R|PF_W|PF_X - flags. */ + /* Set if the "-z execstack" option has been used to request that a + PT_GNU_STACK segment should be created with PF_R, PF_W and PF_X + flags set. + + Note - if performing a relocatable link then a .note.GNU-stack + section will be created instead, if one does not exist already. + The section will have the SHF_EXECINSTR flag bit set. */ unsigned int execstack: 1; - /* TRUE if PT_GNU_STACK segment should be created with PF_R|PF_W - flags. */ + /* Set if the "-z noexecstack" option has been used to request that a + PT_GNU_STACK segment should be created with PF_R and PF_W flags. Or + a non-executable .note.GNU-stack section for relocateable links. + + Note - this flag is not quite orthogonal to execstack, since both + of these flags can be 0. In this case a stack segment can still + be created, but it will only have the PF_X flag bit set if one or + more of the input files contains a .note.GNU-stack section with the + SHF_EXECINSTR flag bit set, or if the default behaviour for the + architecture is to create executable stacks. + + The execstack and noexecstack flags should never both be 1. */ unsigned int noexecstack: 1; /* Tri-state variable: 0 => do not warn when creating an executable stack. - 1 => always warn when creating an executable stack. - >1 => warn when creating an executable stack if execstack is 0. */ + 1 => always warn when creating an executable stack (for any reason). + 2 => only warn when an executable stack has been requested an object + file and execstack is 0 or noexecstack is 1. + 3 => not used. */ unsigned int warn_execstack: 2; + /* TRUE if a warning generated because of warn_execstack should be instead + be treated as an error. */ + unsigned int error_execstack: 1; - /* TRUE if warnings should not be generated for TLS segments with eXecute + /* TRUE if warnings should NOT be generated for TLS segments with eXecute permission or LOAD segments with RWX permissions. */ unsigned int no_warn_rwx_segments: 1; /* TRUE if the user gave either --warn-rwx-segments or - --no-warn-rwx-segments. */ + --no-warn-rwx-segments on the linker command line. */ unsigned int user_warn_rwx_segments: 1; + /* TRUE if warnings generated when no_warn_rwx_segements is 0 should + instead be treated as errors. */ + unsigned int warn_is_error_for_rwx_segments: 1; /* TRUE if the stack can be made executable because of the absence of a .note.GNU-stack section in an input file. Note - even if this field diff --git a/ld/ChangeLog b/ld/ChangeLog index 53bb9c3cee4..fc2478ec197 100644 --- a/ld/ChangeLog +++ b/ld/ChangeLog @@ -1,3 +1,90 @@ +2023-11-10 Nick Clifton + + * ldlex.h (enum option_values): Add OPTION_ERROR_EXECSTACK, + OPTION_NO_ERROR_EXECSTACK, OPTION_WARN_EXECSTACK_OBJECTS, + OPTION_ERROR_RWX_SEGMENTS and OPTION_NO_ERROR_RWX_SEGMENTS. + (struct ld_option): Add new long options. + (parse_args): Parse new long options. + (elf_static_list_options): Display the new options. + * ld.texi: Document the new command line options. + * configure.ac (error-execstack): New configuration option. + (error-rwx-segments): New configuration option. + * emultempl/elf.em (_before_parse): Initialse the new linkinfo + fields. + * NEWS: Mention the new features. + * config.in: Regenerate. + * configure: Regenerate. + * testsuite/ld-elf/commonpage2.d: Disable errors for RWX segments + and/or executable stacks. + * testsuite/ld-elf/elf.exp: Likewise. + * testsuite/ld-elf/header.d: Likewise. + * testsuite/ld-elf/loadaddr1.d: Likewise. + * testsuite/ld-elf/loadaddr2.d: Likewise. + * testsuite/ld-elf/maxpage4.d: Likewise. + * testsuite/ld-elf/nobits-1.d: Likewise. + * testsuite/ld-elf/note-1.d: Likewise. + * testsuite/ld-elf/orphan-10.d: Likewise. + * testsuite/ld-elf/orphan-11.d: Likewise. + * testsuite/ld-elf/orphan-12.d: Likewise. + * testsuite/ld-elf/orphan-5.d: Likewise. + * testsuite/ld-elf/orphan-7.d: Likewise. + * testsuite/ld-elf/orphan-8.d: Likewise. + * testsuite/ld-elf/orphan-9.d: Likewise. + * testsuite/ld-elf/orphan-region.d: Likewise. + * testsuite/ld-elf/orphan.d: Likewise. + * testsuite/ld-elf/pr19539.d: Likewise. + * testsuite/ld-elf/pr26256-1a.d: Likewise. + * testsuite/ld-elf/pr26907.d: Likewise. + * testsuite/ld-elf/pr28597.d: Likewise. + * testsuite/ld-elf/retain2.d: Likewise. + * testsuite/ld-elf/shared.exp: Likewise. + * testsuite/ld-elf/size-1.d: Likewise. + * testsuite/ld-elf/textaddr7.d: Likewise. + * testsuite/ld-elf/warn1.d: Likewise. + * testsuite/ld-elf/warn2.d: Likewise. + * testsuite/ld-i386/discarded1.d: Likewise. + * testsuite/ld-i386/pr19175.d: Likewise. + * testsuite/ld-i386/pr19539.d: Likewise. + * testsuite/ld-i386/pr23189.d: Likewise. + * testsuite/ld-plugin/lto-3r.d: Likewise. + * testsuite/ld-plugin/lto-5r.d: Likewise. + * testsuite/ld-plugin/lto.exp: Likewise. + * testsuite/ld-powerpc/ppc476-shared.d: Likewise. + * testsuite/ld-powerpc/ppc476-shared2.d: Likewise. + * testsuite/ld-powerpc/pr28827-2.d: Likewise. + * testsuite/ld-s390/s390.exp: Likewise. + * testsuite/ld-scripts/align2a.d: Likewise. + * testsuite/ld-scripts/align2b.d: Likewise. + * testsuite/ld-scripts/align5.d: Likewise. + * testsuite/ld-scripts/alignof.exp: Likewise. + * testsuite/ld-scripts/crossref.exp: Likewise. + * testsuite/ld-scripts/defined2.d: Likewise. + * testsuite/ld-scripts/defined3.d: Likewise. + * testsuite/ld-scripts/defined5.d: Likewise. + * testsuite/ld-scripts/pr14962.d: Likewise. + * testsuite/ld-scripts/pr18963.d: Likewise. + * testsuite/ld-scripts/pr20302.d: Likewise. + * testsuite/ld-scripts/print-memory-usage.exp: Likewise. + * testsuite/ld-scripts/rgn-at1.d: Likewise. + * testsuite/ld-scripts/rgn-at10.d: Likewise. + * testsuite/ld-scripts/rgn-at4.d: Likewise. + * testsuite/ld-scripts/rgn-at6.d: Likewise. + * testsuite/ld-scripts/rgn-at8.d: Likewise. + * testsuite/ld-scripts/rgn-at9.d: Likewise. + * testsuite/ld-scripts/rgn-over1.d: Likewise. + * testsuite/ld-scripts/rgn-over2.d: Likewise. + * testsuite/ld-scripts/rgn-over4.d: Likewise. + * testsuite/ld-scripts/rgn-over5.d: Likewise. + * testsuite/ld-scripts/rgn-over6.d: Likewise. + * testsuite/ld-scripts/script.exp: Likewise. + * testsuite/ld-scripts/sizeof.exp: Likewise. + * testsuite/ld-scripts/sort-file.d: Likewise. + * testsuite/ld-x86-64/discarded1.d: Likewise. + * testsuite/ld-x86-64/pr19175.d: Likewise. + * testsuite/ld-x86-64/pr19539a.d: Likewise. + * testsuite/ld-x86-64/pr19539b.d: Likewise. + * testsuite/ld-x86-64/pr23189.d: Likewise. + 2023-11-06 Jan Beulich PR 30722 diff --git a/ld/NEWS b/ld/NEWS index 73eb253b798..835dc39e24b 100644 --- a/ld/NEWS +++ b/ld/NEWS @@ -6,6 +6,15 @@ the order of the sorting. It may be combined with either SORT_BY_NAME or SORT_BY_INIT_PRIORITY. +* Added --warn-execstack-objects to warn about executable stacks only when an + input object file requests one. Also added --error-execstack and + --error-rxw-segments options to convert warnings about executable stacks and + segments into errors. + + Also added --enable-error-execstack=[yes|no] and + --enable-error-rwx-segments=[yes|no] configure options to set the default for + converting warnings into errors. + Changes in 2.41: * The linker now accepts a command line option of --remap-inputs diff --git a/ld/config.in b/ld/config.in index a453c7f7241..e3a983fe3b0 100644 --- a/ld/config.in +++ b/ld/config.in @@ -19,6 +19,14 @@ /* Define if you want compressed debug sections by default. */ #undef DEFAULT_FLAG_COMPRESS_DEBUG +/* Define to 1 if you want to turn executable stack warnings into errors by + default. */ +#undef DEFAULT_LD_ERROR_EXECSTACK + +/* Define to 1 if you want to turn executable segment warnings into errors by + default. */ +#undef DEFAULT_LD_ERROR_RWX_SEGMENTS + /* Define to 0 if you want to disable the generation of an executable stack when a .note-GNU-stack section is missing. */ #undef DEFAULT_LD_EXECSTACK diff --git a/ld/configure b/ld/configure index d2cdf256b89..468c3bd525d 100755 --- a/ld/configure +++ b/ld/configure @@ -847,7 +847,9 @@ enable_relro enable_textrel_check enable_separate_code enable_warn_execstack +enable_error_execstack enable_warn_rwx_segments +enable_error_rwx_segments enable_default_execstack enable_error_handling_script enable_default_hash_style @@ -15669,6 +15671,16 @@ esac fi +ac_default_ld_error_execstack=0 +# Check whether --enable-error-execstack was given. +if test "${enable_error_execstack+set}" = set; then : + enableval=$enable_error_execstack; case "${enableval}" in + yes) ac_default_ld_error_execstack=1 ;; + no) ac_default_ld_error_execstack=0 ;; +esac +fi + + ac_default_ld_warn_rwx_segments=unset # Check whether --enable-warn-rwx-segments was given. if test "${enable_warn_rwx_segments+set}" = set; then : @@ -15679,6 +15691,16 @@ esac fi +ac_default_ld_error_rwx_segments=0 +# Check whether --enable-error-rwx-segments was given. +if test "${enable_error_rwx_segments+set}" = set; then : + enableval=$enable_error_rwx_segments; case "${enableval}" in + yes) ac_default_ld_error_rwx_segments=1 ;; + no) ac_default_ld_error_rwx_segments=0 ;; +esac +fi + + ac_default_ld_default_execstack=unset # Check whether --enable-default-execstack was given. if test "${enable_default_execstack+set}" = set; then : @@ -17444,6 +17466,12 @@ cat >>confdefs.h <<_ACEOF _ACEOF + +cat >>confdefs.h <<_ACEOF +#define DEFAULT_LD_ERROR_EXECSTACK $ac_default_ld_error_execstack +_ACEOF + + if test "${ac_default_ld_warn_rwx_segments}" = unset; then ac_default_ld_warn_rwx_segments=1 fi @@ -17453,6 +17481,12 @@ cat >>confdefs.h <<_ACEOF _ACEOF + +cat >>confdefs.h <<_ACEOF +#define DEFAULT_LD_ERROR_RWX_SEGMENTS $ac_default_ld_error_rwx_segments +_ACEOF + + if test "${ac_default_ld_default_execstack}" = unset; then ac_default_ld_default_execstack=1 fi diff --git a/ld/configure.ac b/ld/configure.ac index c3ebd3ec7e4..cdac7bb0d74 100644 --- a/ld/configure.ac +++ b/ld/configure.ac @@ -225,6 +225,15 @@ AC_ARG_ENABLE(warn-execstack, no) ac_default_ld_warn_execstack=0 ;; esac]) +ac_default_ld_error_execstack=0 +AC_ARG_ENABLE(error-execstack, + AS_HELP_STRING([--enable-error-execstack], + [turn executable stack warnings into errors]), +[case "${enableval}" in + yes) ac_default_ld_error_execstack=1 ;; + no) ac_default_ld_error_execstack=0 ;; +esac]) + ac_default_ld_warn_rwx_segments=unset AC_ARG_ENABLE(warn-rwx-segments, AS_HELP_STRING([--enable-warn-rwx-segments], @@ -234,6 +243,15 @@ AC_ARG_ENABLE(warn-rwx-segments, no) ac_default_ld_warn_rwx_segments=0 ;; esac]) +ac_default_ld_error_rwx_segments=0 +AC_ARG_ENABLE(error-rwx-segments, + AS_HELP_STRING([--enable-error-rwx-segments], + [turn executable segment warnings into errors]), +[case "${enableval}" in + yes) ac_default_ld_error_rwx_segments=1 ;; + no) ac_default_ld_error_rwx_segments=0 ;; +esac]) + ac_default_ld_default_execstack=unset AC_ARG_ENABLE(default-execstack, AS_HELP_STRING([--enable-default-execstack], @@ -549,6 +567,10 @@ AC_DEFINE_UNQUOTED(DEFAULT_LD_WARN_EXECSTACK, $ac_default_ld_warn_execstack, [Define to 1 if you want to enable --warn-execstack in ELF linker by default.]) +AC_DEFINE_UNQUOTED(DEFAULT_LD_ERROR_EXECSTACK, + $ac_default_ld_error_execstack, + [Define to 1 if you want to turn executable stack warnings into errors by default.]) + if test "${ac_default_ld_warn_rwx_segments}" = unset; then ac_default_ld_warn_rwx_segments=1 fi @@ -556,6 +578,10 @@ AC_DEFINE_UNQUOTED(DEFAULT_LD_WARN_RWX_SEGMENTS, $ac_default_ld_warn_rwx_segments, [Define to 0 if you want to disable --warn-rwx-segments in ELF linker by default.]) +AC_DEFINE_UNQUOTED(DEFAULT_LD_ERROR_RWX_SEGMENTS, + $ac_default_ld_error_rwx_segments, + [Define to 1 if you want to turn executable segment warnings into errors by default.]) + if test "${ac_default_ld_default_execstack}" = unset; then ac_default_ld_default_execstack=1 fi diff --git a/ld/emultempl/elf.em b/ld/emultempl/elf.em index 1c5030d5e1c..0fb6226787f 100644 --- a/ld/emultempl/elf.em +++ b/ld/emultempl/elf.em @@ -95,6 +95,8 @@ fragment <