From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1l7smp-0006XR-DZ for mharc-grub-devel@gnu.org; Thu, 04 Feb 2021 23:32:03 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:40232) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1l7smm-0006Vp-A7 for grub-devel@gnu.org; Thu, 04 Feb 2021 23:32:00 -0500 Received: from de-smtp-delivery-102.mimecast.com ([194.104.109.102]:56078) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1l7smj-0008LT-Oo for grub-devel@gnu.org; Thu, 04 Feb 2021 23:32:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=mimecast20200619; t=1612499514; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=XoA0NwQp+kInlm4wCaMg/GbRlNfqdB5+wmk1CB3UBmk=; b=KZQi41jY29Irlr2ziz24BVLT2jGE1Dh6G5OOwhHTfmKbaZr92lkRZeCE/FgkMznUUkzUfJ 6KSPA27oJNKangzKVlYHcyAjEeQSw8W+kolSrv9KIswj6H8rIq06PAjA9tznlqoYnvLy5W aWeI+zDpq2er1sGnIwK31UQtu1l7V68= Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05lp2107.outbound.protection.outlook.com [104.47.18.107]) (Using TLS) by relay.mimecast.com with ESMTP id de-mta-13-RDyjvIxxOsKZckQ71pr4pw-1; Fri, 05 Feb 2021 05:31:52 +0100 X-MC-Unique: RDyjvIxxOsKZckQ71pr4pw-1 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mGqxpqVIoR1KK/MSQ57/tXRyIKwDEadnJoGmYUjEXLi3ttDfHALA0GXWMChLYrP7hLgvKZR4uzFlelhtAVbBjUzMrzyz6WgOyemWWDJ9OBzcXgMPa91ZwUndknA6wnE+nqjuHFPv4PhP/dh0kJ+MVYjI5iuoy1zRnK5uhSphzlc0Hxtg0RHxbfcAP8Uu0d6YgbAeiebxxc1364tdAKeA8WcEUL9QYh1/NJ+sGjg0SwxpliloehYKLfl/D/ZEyKSgozivsxpd/c/W7sCA/Rmxru+um/doPmpGTta+HDJR6T0wzYkQRfK6VyzYAvblarbdGNtt9JZAxuCLIMLyisWVZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XoA0NwQp+kInlm4wCaMg/GbRlNfqdB5+wmk1CB3UBmk=; b=Ktjk30paCPKBG2/AhFwt9uGNsa0yX/y3m3ep0zpMPLEAjbgElmG5Oas/+C7NQwv34WMCoxx2fsUejQkXtKZs69M6fF8RdKhILRJe2FHkjQJQD9snY7qwbZaJ3JVp3sI5gKOKaEjdJ+FxVgI4tYzLSvBJrlp2x/BMBuZnsQVbmnO32TwjHQp9KGyACoX60eovHpUwCrx7hntxD0uLmtLmNx6OMUItSyFvdewVRTjkpZzA64z68JVUP8VcKtOW5j75HnAJh2pD5Pcf8lcsth/BWrACmfNVDJv0+COHZjqARErsqSdzZhzywqyazhu7+iL5Z/ARFSjXaZ66VeHpKk9VpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none Authentication-Results: efficientek.com; dkim=none (message not signed) header.d=none;efficientek.com; dmarc=none action=none header.from=suse.com; Received: from VI1PR04MB4991.eurprd04.prod.outlook.com (2603:10a6:803:57::28) by VI1PR04MB6784.eurprd04.prod.outlook.com (2603:10a6:803:13e::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3825.23; Fri, 5 Feb 2021 04:31:50 +0000 Received: from VI1PR04MB4991.eurprd04.prod.outlook.com ([fe80::28b7:e423:c3d7:7ccf]) by VI1PR04MB4991.eurprd04.prod.outlook.com ([fe80::28b7:e423:c3d7:7ccf%6]) with mapi id 15.20.3805.034; Fri, 5 Feb 2021 04:31:50 +0000 Date: Fri, 5 Feb 2021 12:31:35 +0800 From: Michael Chang To: Glenn Washburn Cc: Michael Chang via Grub-devel Subject: Re: [PATCH] emu: fix executable stack marking Message-ID: <20210205043135.GA14650@mercury> References: <20210203130344.14720-1-mchang@suse.com> <20210204162810.0c7c1e20@crass-HP-ZBook-15-G2> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210204162810.0c7c1e20@crass-HP-ZBook-15-G2> User-Agent: Mutt/1.10.1 (2018-07-13) X-Originating-IP: [2001:b011:30d0:3a26:99cd:b197:678e:8274] X-ClientProxiedBy: HK2P15301CA0009.APCP153.PROD.OUTLOOK.COM (2603:1096:202:1::19) To VI1PR04MB4991.eurprd04.prod.outlook.com (2603:10a6:803:57::28) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from mercury (2001:b011:30d0:3a26:99cd:b197:678e:8274) by HK2P15301CA0009.APCP153.PROD.OUTLOOK.COM (2603:1096:202:1::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3846.15 via Frontend Transport; Fri, 5 Feb 2021 04:31:48 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f8c1cfb5-095a-409a-ba69-08d8c98ef401 X-MS-TrafficTypeDiagnostic: VI1PR04MB6784: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: neOzFNI+nWyMjOyRB2QDZStRud7/7qzliGPO+os5eL1xSFRvEtCZHR8l0T1PDQ9LEjHsOq+G3hYuP7gjqRLv+H5eU80uU7K7e9qwB49lmxojeHLuHEGWhf1oxfQH6M37/HqftKooe+tE3i9OWN54xQcWAN9OMigoL7mn7ggne08GB1rcuIcjFOph4hbOekP24/HHYbbiEKyk4M4QWanaiKqnbDDwaor+WmKld95ryR3ZLMvnDu7OjwOPH1xsL4/RyenZtskK4CXgF/6E7nm0LmcSL3bOlxMLC271t6kQXNvbAUxxAfUBoxCac0tVEL/AINej0XGxFU0EAAijncKIg4H/j4VqN/WTvRp3STONlrerXc8z7pWezm2YGg+PAZI9dnRpsvPVB6cIbUJfeNuwr5mKwJPyeddRgxDbRF1YGiTaP+zDKAQC9m6SpGwCdOV9mzG3tr67TRwz8lVhB3+vAkC4FI7s+sWzL3zBhUaQLmxzhd6FrKW0uABQuGftdojEg8+BOUIrKnFUjJHPHJ5asw== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI1PR04MB4991.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(396003)(39860400002)(366004)(136003)(376002)(346002)(9576002)(8676002)(478600001)(6666004)(9686003)(8936002)(55016002)(2906002)(4326008)(1076003)(86362001)(33656002)(33716001)(186003)(16526019)(316002)(5660300002)(66556008)(66476007)(66946007)(6496006)(52116002)(83380400001)(6916009); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?SEecG5IFGVHPg8n7lKrpgj2vJh9Pev33nwbGk7bsckoAhWI0969p5FhRMLiY?= =?us-ascii?Q?zgkbcEmfDhwKK0B1r4PVebju4D1ZeYIfPp1JxiLiGIPCEt5cYZWG9bY7Coi+?= =?us-ascii?Q?xn8C5/WV1Ov0rfbVGJmFtLuswXfXqZZZUgcSIqjJLAlEBPSR5T0wW3feth+j?= =?us-ascii?Q?LP+9OWpngk69+OCHuQ4rXc353hk89V5Tfs3XlP/R8/CgMVIjN+MNxIH6u4Cx?= =?us-ascii?Q?uPCMTyINGEHg0T74XxsQLhVM3BaJaT+/lXxfgW9uSzL/aoFwl1VsC6La/MmV?= =?us-ascii?Q?tuoEP7JWSdE7bWSnoUGHeTP/gJQd3e6qp8r5qLLgp8TDVvI2HqcddWQI8Mb/?= =?us-ascii?Q?OdB7IDDHIfWaFPoT7TYL3fp5i1LRjj1o0y1cmYmr8HNTESXFJIblap13jZLA?= =?us-ascii?Q?Qlx6vTPpaP1N5et9QmbtYXxHTTJymc28Id5mHzTOitR1xvrWKaMWt0vwqI+A?= =?us-ascii?Q?nvXxjfr3FT+VgVVrTTlehvPvT6ihV4QxW3oF1wtXvbW3MJ4LNXGu34e1gTd0?= =?us-ascii?Q?b1w7ntUXGtSLqqecrSIOuGnVRd6OCULtUOYuGZjqZb2yD+yL50W0c41AWPT6?= =?us-ascii?Q?x4XVaiMWf8n1TV6SLx5MShclgAip2eEUYAL+ZHyDOAxz5pW9HXSKfgf6/F6G?= =?us-ascii?Q?amnSuhbXulDGDzVGIvUUSnm02or4H8BwP7qKHZZZC20syJ9yAf6lE3XAikRh?= =?us-ascii?Q?3cQzW3z+F9xJD1u2WiSIK7dYoyOvNSmavv0AGrGl7LhUzqcUjz5xg+lA2DoO?= =?us-ascii?Q?VUBbt7b/talThtjngGz0+TTpm0oZWxlAFXGmPoq2RcJe8w1AGc2IwKZb+vrM?= =?us-ascii?Q?9oiFZi2P24deXcgrgHR953TWr/B371o8o9f7ZzkC43ptE9ZJJ4Jhmx3TV9rF?= =?us-ascii?Q?SaA/obdtx4nRC0fuC88afyFsQjBY99R9qNVi5Gbr4LHQE7mKNRjpwDK4qDPH?= =?us-ascii?Q?FmPU8CHCPPDeKmiAlcW3Syuz8bwtpBxHeSaMsGv+5YUPUsvYmPlY+BrMFUMj?= =?us-ascii?Q?SJ6PxwJPcztko+gXWfeHOhxk/uhfNNcm2QjPgXEitDtCtBD+dVhwJxXod528?= =?us-ascii?Q?2YMZBWcdPpINMQ0v74rr52GNBcMS7rH6pnZzxNW20fvK7yddxgB65Mm1Qx/Y?= =?us-ascii?Q?1r4PCxekvdfSf83W+9AtHCfa006GKzB1LkV/CY6JBleVMVd9PVJOk2KiAmlp?= =?us-ascii?Q?p0YnBfFdWzGWGqtZbbMkJ0D3cldc/owBvVxfLoQKgae4f5vERUHD6ECojtqi?= =?us-ascii?Q?lR7LWNP2Ex2VmGxA05209VEdnjaSpQrED6/WVYRELF6TZJlQAn7SujO/ATvH?= =?us-ascii?Q?vnVxz8Okr1TfJLwRDUqPoe5fx1jvKNGrHzmTejr7wl3UtZk5YNOh39plGN4T?= =?us-ascii?Q?voz+D5jEbIoZ5GCO8sCghVSc3uJq?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: f8c1cfb5-095a-409a-ba69-08d8c98ef401 X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB4991.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Feb 2021 04:31:49.7323 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: buw0+8HnvdYgdRg1p4spCxeOpEA7cU88bfGrl90ThqBM9vOm+XFx8kHZIVI/W2jr X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB6784 Received-SPF: pass client-ip=194.104.109.102; envelope-from=mchang@suse.com; helo=de-smtp-delivery-102.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Feb 2021 04:32:00 -0000 On Thu, Feb 04, 2021 at 04:28:10PM -0600, Glenn Washburn wrote: > Hi Michael, > > On Wed, 3 Feb 2021 21:03:44 +0800 > Michael Chang via Grub-devel wrote: > > > The gcc by default assumes executable stack is required if the source > > object file doesn't have .note.GNU-stack section in place. If any of > > the source objects doesn't incorporate the GNU-stack note, the > > resulting program will have executable stack flag set in PT_GNU_STACK > > program header to instruct program loader or kernel to set up the > > exeutable stack when program loads to memory. > > > > Usually the .note.GNU-stack section will be generated by gcc > > automatically if it finds that executable stack is not required. > > However it doesn't take care of generating .note.GNU-stack section > > for those object files built from assembler sources. This leads to > > unnecessary risk of security of exploiting the executable stack > > because those assembler sources don't actually require stack to be > > executable to work. > > > > The grub-emu and grub-emu-lite are found to flag stack as executable > > revealed by execstack tool. > > > > $ mkdir -p build-emu && cd build-emu > > $ ../configure --with-platform=emu && make > > $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite > > X grub-core/grub-emu > > X grub-core/grub-emu-lite > > > > This patch will add the missing GNU-stack note to the assembler source > > used by both utilities, therefore the result doesn't count on gcc > > default behavior and the executable stack is disabled. > > > > $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite > > - grub-core/grub-emu > > - grub-core/grub-emu-lite > > Am I correct in thinking that this isn't as useful for the bootloader > itself because, I assume, the grub linker doesn't look at that section > header or flag. I'm wondering if it might be worthwhile to do this for > grub modules for instance. The .note.GNU-stack section does exist in host's .module files but gets stripped out by genmod.sh during the build process for the target grub modules (*.mod). It could be intentional for the good of taking less memory footprint, as you have mentioned that bootloader itself don't use it thus it is reasonable to do so. But I could imagine that it is unpleasant to see scanelf to output "bad things" of grub modules. !WX --- --- ./grub-core/read.mod I think we can attribute this to be a cosmetic issue and the "fix" may be otherwise unfavourable to the grub itself. Thanks, Michael > > Glenn >