From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1mAURk-0006jj-2m for mharc-grub-devel@gnu.org; Mon, 02 Aug 2021 05:41:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57456) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAURi-0006gb-1H for grub-devel@gnu.org; Mon, 02 Aug 2021 05:41:18 -0400 Received: from de-smtp-delivery-102.mimecast.com ([194.104.109.102]:58073) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAURg-0002q6-DJ for grub-devel@gnu.org; Mon, 02 Aug 2021 05:41:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=mimecast20200619; t=1627897272; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QaVt0wODXQPpWmW7U6njA6TA0dFIDt/i0KEjfs5yje4=; b=dkkMra4IKmdLC8yAN6th3dSaPYyk7uyHxuk5LTvVECasRQaIJWIFnf2I0I+JyxZYDcHwDB W6CCSMncfHpB85wAdXLfTs2wuUVdrCoeFkONNSCQ3941Ly1ypcdHRf0/ck3kW5LTCYFcwC lfziXp322RwjijG40VEmRRWUQt0ZT2g= Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02lp2059.outbound.protection.outlook.com [104.47.4.59]) (Using TLS) by relay.mimecast.com with ESMTP id de-mta-17-MLqIvGSuPFiih83dhMQb1Q-1; Mon, 02 Aug 2021 11:41:11 +0200 X-MC-Unique: MLqIvGSuPFiih83dhMQb1Q-1 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oFLGp+qsRBfExxo+u9+CxajxJNV2gQD47e2W9Ntc6liZgIZUZWIGhnEP2pJrjeJbHcvVIbManl6uT82LfEzjSwC53ZDvqyRNBhrwDErML6hGbRhbUq4ubW1dBL4kdKwyq9pJfYHZKnLLRAAdvtsEUtn9LBgVLct1SZEH3cod9zQSVnEDd6Q+5VzfaaxPjubafpIsZHAg1WzBSKTACVRkvBEsNW4EAw+LIh5c80EZgqHolcQLyf4Evr1r48CeUJ1rpJdzSF2JC8xoouNXVR0CtvtelKVN6q4HiSK9VF3Gt3AXUVKbgSiF+js/WYht78xU6tZxEzxymPJ6anu+DFTPOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WlEYLyUxiEowev72hgo7MtIQGdJdvzb/yD/VQ8qnONE=; b=ixI6Hab8RW5bmwBZSjvlfqUiykL75g97oIE6RxgBjq2qu7RIkOBo575jPUcImNABh03Mq76xgnyr9M38+snSX8OhwkU8RimLeyAuP9MU+MXfsod0++iB8w7EV7E/U6rsdb+2KgYz4+7fqYrJYSdkNXgYVMPr4/tXVKcFbFlhK6RG3dRi/JAYmVX7mQF34lO5e9hw03vQ7Jcry9y57J8y9hDuDHhfmRuFyHbNqZis5xRLiY9b/Zn+jSGzTzWSqlDPuc2xBk9nhzVO7BBYzq4sCRFhO3vZ6WKDPy4MbKfOANjd8shBOLj2vhS/yKagYCT+UtosMRzgVOlMsU3lpj+UWw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none Authentication-Results: gnu.org; dkim=none (message not signed) header.d=none;gnu.org; dmarc=none action=none header.from=suse.com; Received: from DU2PR04MB8648.eurprd04.prod.outlook.com (2603:10a6:10:2df::21) by DU2PR04MB8760.eurprd04.prod.outlook.com (2603:10a6:10:2e3::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.21; Mon, 2 Aug 2021 09:41:10 +0000 Received: from DU2PR04MB8648.eurprd04.prod.outlook.com ([fe80::245b:a7da:fcc:25a1]) by DU2PR04MB8648.eurprd04.prod.outlook.com ([fe80::245b:a7da:fcc:25a1%5]) with mapi id 15.20.4373.026; Mon, 2 Aug 2021 09:41:10 +0000 From: Michael Chang To: The development of GNU GRUB Subject: [PATCH] emu: fix executable stack marking Date: Mon, 2 Aug 2021 17:40:57 +0800 Message-ID: <20210802094057.19319-1-mchang@suse.com> X-Mailer: git-send-email 2.31.1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain X-ClientProxiedBy: HK0PR03CA0117.apcprd03.prod.outlook.com (2603:1096:203:b0::33) To DU2PR04MB8648.eurprd04.prod.outlook.com (2603:10a6:10:2df::21) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost (114.44.49.216) by HK0PR03CA0117.apcprd03.prod.outlook.com (2603:1096:203:b0::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Mon, 2 Aug 2021 09:41:09 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: fbf61330-02bf-4a65-584d-08d95599a904 X-MS-TrafficTypeDiagnostic: DU2PR04MB8760: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2657; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: jcvn5V3u1QoXZilzXYS1bjqghWtI4Z/WWCfwWWKESqgdGjtnU48pBG//QBY7JhcSxo40Ul9nAq6EkM/tukxgzpNHy+JxQP0bUztaFjClxBog+kK9iQiZykfeqKYidkUSSoDwbqN/poAL1QxFkKPxLyITEF1G57i7DnrivH5n0E6nitwvJQJ4buDiiAk2W/b8GDzHLp7edYdqSJVOujiaoUBuRYtrjYqR9ZC0MyEq7EHRnAanpp9tVYRc76iq9Kg678IpZe6wzAbmQThnxBa3xnKClTVmQfQ6N68oWNXV3hjZc5AvivVsmzGwUZbO2p33J4a+Bz3KfGrD9GQA4WkDzYQNejEyPG9zifVAku4kCwJXybETCOi8YpPItBUmx2mWkIZqNeHnTzOKr7T4J7PhhCk4PRu6mOHBWMawrP7D8B+eyiW4qpVejtxvjBswAzmbi5O/W8VbJUEXBrzmwPVyFwqN4dT6cv+XSDf5aw37RNIJpQMMErUXCHhb3AFYDCp8XINYJVsl6vgrOmPb7p0EC8NpAm1bE/UyI4uKxe/NDUCnUNekvtsaEj4v5EAc5efv876MdMNgusf2i30wMzV5RNsIgi+L1pd/moZPfIhr98yrXNmFJ3dIeeKANTxy76E6fpRkL/28LUC4HtevaUqaPTjOR7hrGrH2GxBM4jTO5AH3eFoFQPREHjs/i7SKPxTs X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DU2PR04MB8648.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(39850400004)(346002)(376002)(136003)(396003)(366004)(86362001)(8936002)(1076003)(8676002)(66556008)(66476007)(186003)(66946007)(26005)(6916009)(6666004)(83380400001)(36756003)(316002)(38100700002)(6496006)(2906002)(956004)(2616005)(6486002)(478600001)(5660300002)(11716005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?a7G3Kb0p7+kp8xIRvqGQFQqv3QSAh4FbVuScOO+vXRaIUvTKEgz7DJ08exbT?= =?us-ascii?Q?QrcwBV1tpcbZ7LeJrgUC3TYLiEodTclsCyKFLiC1EmoP3Zyin5cvypWqOmAv?= =?us-ascii?Q?FvNec15FxoNFOR0u+9E8kKQX0e0PzdKV5Rmzi+EAIiRBwYXw39cYxnmdTbtx?= =?us-ascii?Q?GzeO2pDpd4dZe69MIuGWr6BoXBqQmFHtZfyBc6vR/vD/6GYNJNYlHJXPmpoq?= =?us-ascii?Q?atI94k4CmLutW9p7sMWZ72Rmk5cD4G69luh+D8YD/s8Ow8xgB6Ad1CvJscDj?= =?us-ascii?Q?iG2Zn8/kWYOXh50tV3nPj0LUp6rPhmlRHo9fWGNrhq7EXBgJzJIIYrNkO+qK?= =?us-ascii?Q?UrbVtSFq5Zp8mMqZcKuGkyjG47ytGnU6pqkeUdUFf2fbXdcM2RZSDTRGoMc6?= =?us-ascii?Q?SB6XtPxQtfDLcL0z1WtKDw7yN2SBpErsZVB9DVcG/mBu2JPOsu6K3iLzWYme?= =?us-ascii?Q?z9axZsmFsh7FWuihbzZi9xEE9Yq2sipTvb1Q2ZfrPZwcfcEa9b2zPe+RdVdo?= =?us-ascii?Q?Dtm55xOUGPJGNmnVlMSNxrLqtZJSEkNme639gwl070n0pA8seCejBiSYJ4JT?= =?us-ascii?Q?GF0i/7J4Na0pWGlnnO2/CmRsNXURyWlWqjTZ+k8+dwPakQLYmDtHqwVCg+KA?= =?us-ascii?Q?7p9lBO7tlX0UTF+6umkBwggSMkHRYs26QVOAbXjUXVShhbGH+rzD8cJvbT+S?= =?us-ascii?Q?fS9jITMb7vU9ekJB5ZAvPB77kEO4E4TR7o5pVBBQMQu2k+HYtf5xyekuMXsq?= =?us-ascii?Q?okJquMQM1jVko1L0RuFxgKX+sqbuiz0fPch/qH/eZ6Rul+Pdc6Z2prp17zzu?= =?us-ascii?Q?iYbHNByWQXqJKbgkIwGIpsthkvQ9D/krvdXmS0dO+lsBJCEZznX4FK9g3LbW?= =?us-ascii?Q?KMtcarNU1nIc21SssExRqU7jhBHtIvIZJxJ2iZ2BlOd9/arNXQa51dB/HHEc?= =?us-ascii?Q?osERkctvQMqsA3YKNnXpCKUSlyEpA7xifLA/NTw+OdXPOxs2Xgigrm7fxaFk?= =?us-ascii?Q?9OXQUXQiv38qF7uqvklCcNm+mtQdn140UKrOoF2SQk8E0zTvpHzJ/E9v8FqT?= =?us-ascii?Q?+XV8RfH4JK/iI0/QfSUj+fsMksYa0zbtoTmwGLhJU8xk1i76zjzERT5vZ9r9?= =?us-ascii?Q?0YeOJYBl/XGh3oy0qClMCQ/DasLKxF0jhxZfHyuxgquWIw0+VG7byw4oOjcF?= =?us-ascii?Q?eLEL0tnbSya19/DQWXdIwUJbjy/Kva2coFJ/OOrzhMtcc1RmrMwZ3dgw4BUw?= =?us-ascii?Q?A9bKyDRKlH9ZC4L3Ce9x2ohDBeRSjxZxYVSv8fzRRJ5dJcZcmAkPgEs7w5Pd?= =?us-ascii?Q?92qHmT7kRp0cYuJjyQ+JlREu?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: fbf61330-02bf-4a65-584d-08d95599a904 X-MS-Exchange-CrossTenant-AuthSource: DU2PR04MB8648.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Aug 2021 09:41:10.4523 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: oBR3GaeYnKNdLBZdZnYXW6atzzaRwSiSmVZVwQrkaAtRcVZXkMAF49xUdAKz0hTW X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU2PR04MB8760 Received-SPF: pass client-ip=194.104.109.102; envelope-from=mchang@suse.com; helo=de-smtp-delivery-102.mimecast.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Aug 2021 09:41:18 -0000 The gcc by default assumes executable stack is required if the source object file doesn't have .note.GNU-stack section in place. If any of the source objects doesn't incorporate the GNU-stack note, the resulting program will have executable stack flag set in PT_GNU_STACK program header to instruct program loader or kernel to set up the exeutable stack when program loads to memory. Usually the .note.GNU-stack section will be generated by gcc automatically if it finds that executable stack is not required. However it doesn't take care of generating .note.GNU-stack section for those object files built from assembler sources. This leads to unnecessary risk of security of exploiting the executable stack because those assembler sources don't actually require stack to be executable to work. The grub-emu and grub-emu-lite are found to flag stack as executable revealed by execstack tool. $ mkdir -p build-emu && cd build-emu $ ../configure --with-platform=3Demu && make $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite X grub-core/grub-emu X grub-core/grub-emu-lite This patch will add the missing GNU-stack note to the assembler source used by both utilities, therefore the result doesn't count on gcc default behavior and the executable stack is disabled. $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite - grub-core/grub-emu - grub-core/grub-emu-lite Signed-off-by: Michael Chang --- grub-core/kern/emu/cache_s.S | 5 +++++ grub-core/lib/setjmp.S | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/grub-core/kern/emu/cache_s.S b/grub-core/kern/emu/cache_s.S index 2245cddc3..c35926f6b 100644 --- a/grub-core/kern/emu/cache_s.S +++ b/grub-core/kern/emu/cache_s.S @@ -2,6 +2,11 @@ #error "This source is only meant for grub-emu platform" #endif =20 +/* An executable stack is not required for these functions */ +#if defined (__linux__) && defined (__ELF__) +.section .note.GNU-stack,"",%progbits +#endif + #if defined(__i386__) || defined(__x86_64__) /* Nothing is necessary. */ #elif defined(__sparc__) diff --git a/grub-core/lib/setjmp.S b/grub-core/lib/setjmp.S index aa297ab0a..e6c3608e1 100644 --- a/grub-core/lib/setjmp.S +++ b/grub-core/lib/setjmp.S @@ -1,3 +1,7 @@ +/* An executable stack is not required for these functions */ +#if defined (__linux__) && defined (__ELF__) +.section .note.GNU-stack,"",%progbits +#endif #if defined(__i386__) #include "./i386/setjmp.S" #elif defined(__x86_64__) --=20 2.31.1