READ_IMPLIES_EXEC set when no GNU_STACK header present

READ_IMPLIES_EXEC set when no GNU_STACK header present

[Seth Forshee]

We recently noticed that all of our applications had the execute
permission set for any mappings with read permission on an ARMv6
platform. This is happening because the ELF images do not have a
GNU_STACK program header, causing executable_stack=EXSTACK_DEFAULT to be
passed to arm_elf_read_implies_exec(), and it immediately returns 1.

Is this intentional or just an oversight? The patch below removes
READ_IMPLIES_EXEC when GNU_STACK is not present; if this is the desired
behavior I can submit it to the patch system.



commit 6e6d10ae2b5967ce9e9ebe9ebcc6df26a6b57854
Author: Seth Forshee <seth.forshee@gmail.com>
Date:   Tue Aug 3 13:50:41 2010 -0500

    [ARM] enable NX support by default
    
    arm_elf_read_implies_exec() currently returns 1 unless non-
    executable stacks are explicitly requested. This results in
    READ_IMPLIES_EXEC being set for elf images without a GNU_STACK
    program header, even though executable stacks aren't actually
    being requested. This function should default to enabling NX when
    the architecture supports it for better security.
    
    Signed-off-by: Seth Forshee <seth.forshee@gmail.com>

diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index d4a0da1..a2eaa6d 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -74,7 +74,7 @@ EXPORT_SYMBOL(elf_set_personality);
  */
 int arm_elf_read_implies_exec(const struct elf32_hdr *x, int executable_stack)
 {
-	if (executable_stack != EXSTACK_DISABLE_X)
+	if (executable_stack == EXSTACK_ENABLE_X)
 		return 1;
 	if (cpu_architecture() < CPU_ARCH_ARMv6)
 		return 1;

READ_IMPLIES_EXEC set when no GNU_STACK header present

[Russell King - ARM Linux]

On Tue, Aug 03, 2010 at 02:58:16PM -0500, Seth Forshee wrote:
> We recently noticed that all of our applications had the execute
> permission set for any mappings with read permission on an ARMv6
> platform. This is happening because the ELF images do not have a
> GNU_STACK program header, causing executable_stack=EXSTACK_DEFAULT to be
> passed to arm_elf_read_implies_exec(), and it immediately returns 1.

That's correct behaviour.  Historically, ARM ELF binaries don't have
the GNU_STACK program header, but expect read+exec behaviour from the
stack.

>     [ARM] enable NX support by default
>     
>     arm_elf_read_implies_exec() currently returns 1 unless non-
>     executable stacks are explicitly requested. This results in
>     READ_IMPLIES_EXEC being set for elf images without a GNU_STACK
>     program header, even though executable stacks aren't actually
>     being requested. This function should default to enabling NX when
>     the architecture supports it for better security.

NAK.  If you want NX, you must ensure that your applications are built
correctly.

READ_IMPLIES_EXEC set when no GNU_STACK header present

[Seth Forshee]

On Tue, Aug 03, 2010 at 09:02:34PM +0100, Russell King - ARM Linux wrote:
> On Tue, Aug 03, 2010 at 02:58:16PM -0500, Seth Forshee wrote:
> > We recently noticed that all of our applications had the execute
> > permission set for any mappings with read permission on an ARMv6
> > platform. This is happening because the ELF images do not have a
> > GNU_STACK program header, causing executable_stack=EXSTACK_DEFAULT to be
> > passed to arm_elf_read_implies_exec(), and it immediately returns 1.
> 
> That's correct behaviour.  Historically, ARM ELF binaries don't have
> the GNU_STACK program header, but expect read+exec behaviour from the
> stack.

Okay, thanks for the explanation.