scripts/check-execstack.awk

   1 # This awk script expects to get command-line files that are each
   2 # the output of 'readelf -l' on a single shared object.
   3 # But the first file should contain just "execstack-no" or "execstack-yes",
   4 # indicating what the default is in the absence of PT_GNU_STACK.
   5 # It exits successfully (0) if none indicated executable stack.
   6 # It fails (1) if any did indicate executable stack.
   7 # It fails (2) if the input did not take the expected form.
   8
   9 BEGIN { result = sanity = 0; default_exec = -1 }
  10
  11 /^execstack-no$/ { default_exec = 0; next }
  12 /^execstack-yes$/ { default_exec = 1; next }
  13
  14 function check_one(name) {
  15   if (default_exec == -1) {
  16     print "*** missing execstack-default file?";
  17     result = 2;
  18   }
  19
  20   if (!sanity) {
  21     print name ": *** input did not look like readelf -l output";
  22     result = 2;
  23   } else if (stack_line) {
  24     if (stack_line ~ /^.*RW .*$/) {
  25       print name ": OK";
  26     } else if (stack_line ~ /^.*E.*$/) {
  27       print name ": *** executable stack signaled";
  28       result = result ? result : 1;
  29     }
  30   } else if (default_exec) {
  31     print name ": *** no PT_GNU_STACK entry";
  32     result = result ? result : 1;
  33   } else {
  34     print name ": no PT_GNU_STACK but default is OK";
  35   }
  36
  37   sanity = 0;
  38 }
  39
  40 FILENAME != lastfile {
  41   if (lastfile)
  42     check_one(lastfile);
  43   lastfile = FILENAME;
  44 }
  45
  46 $1 == "Type" && $7 == "Flg" { sanity = 1; stack_line = "" }
  47 $1 == "GNU_STACK" { stack_line = $0 }
  48
  49 END {
  50   check_one(lastfile);
  51   exit(result);
  52 }