From: Michael Chang <mchang@suse.com>
To: The development of GNU GRUB <grub-devel@gnu.org>
Subject: Re: [PATCH] emu: fix executable stack marking
Date: Mon, 9 Aug 2021 13:05:12 +0800 [thread overview]
Message-ID: <20210809050512.GB13488@mercury> (raw)
In-Reply-To: <20210805150505.l5npdmge7afibvk2@tomti.i.net-space.pl>
On Thu, Aug 05, 2021 at 05:05:05PM +0200, Daniel Kiper wrote:
> On Mon, Aug 02, 2021 at 05:40:57PM +0800, Michael Chang via Grub-devel wrote:
> > The gcc by default assumes executable stack is required if the source
> > object file doesn't have .note.GNU-stack section in place. If any of the
> > source objects doesn't incorporate the GNU-stack note, the resulting
> > program will have executable stack flag set in PT_GNU_STACK program
> > header to instruct program loader or kernel to set up the exeutable
> > stack when program loads to memory.
> >
> > Usually the .note.GNU-stack section will be generated by gcc
> > automatically if it finds that executable stack is not required. However
> > it doesn't take care of generating .note.GNU-stack section for those
> > object files built from assembler sources. This leads to unnecessary
> > risk of security of exploiting the executable stack because those
> > assembler sources don't actually require stack to be executable to work.
> >
> > The grub-emu and grub-emu-lite are found to flag stack as executable
> > revealed by execstack tool.
>
> Did you test all executables for all supported architectures and platforms?
No. But the test should cover grub executables on as many plarforms as
possbile as follow.
i386-pc
i386-efi
x86_64-efi
powerpc-ieee1275
arm64-efi
x86_64-xen
x86_64-emu
arm64-emu
> > $ mkdir -p build-emu && cd build-emu
> > $ ../configure --with-platform=emu && make
> > $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite
> > X grub-core/grub-emu
> > X grub-core/grub-emu-lite
> >
> > This patch will add the missing GNU-stack note to the assembler source
> > used by both utilities, therefore the result doesn't count on gcc
> > default behavior and the executable stack is disabled.
> >
> > $ execstack -q grub-core/grub-emu grub-core/grub-emu-lite
> > - grub-core/grub-emu
> > - grub-core/grub-emu-lite
> >
> > Signed-off-by: Michael Chang <mchang@suse.com>
>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Thanks for reviewing the patch.
Regards,
Michael
>
> Daniel
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
next prev parent reply other threads:[~2021-08-09 5:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-02 9:40 [PATCH] emu: fix executable stack marking Michael Chang
2021-08-05 15:05 ` Daniel Kiper
2021-08-09 5:05 ` Michael Chang [this message]
-- strict thread matches above, loose matches on Subject: below --
2021-02-03 13:03 Michael Chang
2021-02-04 22:28 ` Glenn Washburn
2021-02-05 4:31 ` Michael Chang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210809050512.GB13488@mercury \
--to=mchang@suse.com \
--cc=grub-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.