include noexecstack hardening flag on Linux#1064
Conversation
Mark the stack memory as non-executable using the '-Wl,-z,noexecstack' flag on aarch64 and x86_64 linux platforms. Other linux targets are cross-compiled, this flag is left off for the time being. closes astral-sh#1061
indygreg
left a comment
indygreg
left a comment
There was a problem hiding this comment.
As a follow-up, please teach the ELF validation code to ensure that the stack isn't executable.
Remove -use-gnu-stack from the BOLT flags used to optimize CPython as it incorrectly removes the PT_GNU_STACK segment causing glibc to default to an executable stack, for example when creating a new thread. This can be reverted when llvm/llvm-project#174191 is fixed in LLVM Should be applied after #1064 closes #956
|
This is fine, but I'd also like to track down why this is happening, if possible. Is it some assembly file somewhere? |
I should have included a mention of llvm/llvm-project#186004 in this issue and the commit message. It is discussed in #1061 LLVM 22 does not emit a |
|
Wait, why is this not relevant for cross-compiled targets? |
A non-executable stack is relevant for all targets, both native and cross but the cross-compiled targets use gcc for compilation so should not be effected by the llvm bug. That said, adding |
Mark the stack memory as non-executable using the '-Wl,-z,noexecstack' flag on aarch64 and x86_64 linux platforms. Other linux targets are cross-compiled, this flag is left off for the time being. closes astral-sh#1061
Remove -use-gnu-stack from the BOLT flags used to optimize CPython as it incorrectly removes the PT_GNU_STACK segment causing glibc to default to an executable stack, for example when creating a new thread. This can be reverted when llvm/llvm-project#174191 is fixed in LLVM Should be applied after astral-sh#1064 closes astral-sh#956
3 participants
Mark the stack memory as non-executable using the '-Wl,-z,noexecstack' flag on aarch64 and x86_64 linux platforms.
Other linux targets are cross-compiled, this flag is left off for the time being.
closes #1061