CHICKEN Scheme

Summary

disable executable stack sections

Metadata

Id: b9d6f16711083385d69b9bcc7045b1d82009b1d6
Trac id: 65
Type: defect
Reporter: felix
Owner:
Cc:
Status: closed
Component: build system
Estimated difficulty:
Resolution: fixed
Priority: major
Milestone:
Version: 4.1.x
Changetime: 2009-12-01 16:01:13 UTC
Created: 2009-08-06 09:11:00 UTC
Keywords:

Attachments

b9d6f16711083385d69b9bcc7045b1d82009b1d6/attachments/non-exec-stack.diff.txt

Description

(reported by Marijn Schouten)

 automatic scanning by our package manager reports that the following files
 contain executable stack sections[1]:
 
  * RWX --- --- usr/bin/chicken-bug
  * !WX --- --- usr/lib64/libuchickenchicken-4.1.0.tar.gz:apply-hack.x86-64.o
  * !WX --- --- usr/lib64/libchickenchicken-4.1.0.tar.gz:apply-hack.x86-64.o
  * RWX --- --- usr/lib64/libchicken.so
  * RWX --- --- usr/lib64/libuchicken.so

http://www.gentoo.org/proj/en/hardened/gnu-stack.xml indicates that at least the hacked-apply assembly files need to be patched.

Changes and comments

[2009-08-12 09:41:57 UTC] zbigniew attached non-exec-stack.diff.txt (description=non-exec stack)

[2009-08-12 09:44:07 UTC] zbigniew wrote:

Looks like patching apply-hack.x86.s and apply-hack.x86-64.s does fix the issue according to scanelf/readelf from the pax-utils package.

[2009-08-12 09:54:10 UTC] zbigniew wrote:

FYI, prior to patch:

 ~/scheme/chicken-4$ scanelf -qe *
 !WX --- ---  apply-hack.x86-64.o
 RWX --- ---  chicken-boot
 RWX --- ---  chicken-bug
 RWX --- ---  libchicken.so
 RWX --- ---  libuchicken.so

After patch and `make`:

 ~/scheme/chicken-4$ scanelf -qe *
 RWX --- ---  chicken-boot

After `make bootstrap`:

 ~/scheme/chicken-4$ scanelf -qe *

[2009-08-14 19:19:33 UTC] felix changed status from new to closed

[2009-08-14 19:19:33 UTC] felix set resolution to fixed

[2009-08-14 19:19:33 UTC] felix wrote:

Applied in r15484. Thanks for testing this.