binutils as policy checker (was: RFC: Add a linker warning when creating segments with RWX permissions)

[Michael Matz]

Hey,

On Thu, 28 Apr 2022, Nick Clifton via Binutils wrote:

>     * There are now configure options which can turn off the generation
>       of linker warnings about the creation of executable segments and
>       the creation of executable stacks.  By default however not using
>       these configure options will result in the creation of a linker
>       with all of the warnings enabled.
> 
>     * There is new linker command line option: --no-warn-rwx-segments
>       which disables the warnings about executable segments.
> 
>     * There are tests for the new features, plus extra regexps in the
>       testsuite's pruning proc to remove the warnings from the linker's
>       output for normal tests.
> 
>     * The creation of a TLS segment with eXecute permission will trigger
>       a warning, regardless of whether it has the read and/or write
>       permissions set.
> 
>     * There is a new configure time option which will disable the
>       creation of an executable stack simply because an input file is
>       missing a .note-GNU-stack section (for those architectures where
>       such a creation is the normal behaviour).  This option is not
>       enabled by default however.  At least not yet.
> 
>   I think that this represents the best compromise between helping to
>   promote secure builds whilst also allowing toolchain creators and
>   program builders the option to disable the features if they wish.
> 
>   Any comments ?

Works for me.


Ciao,
Michael.