binutils as policy checker (was: RFC: Add a linker warning when creating segments with RWX permissions)

[H.J. Lu]

On Tue, May 3, 2022 at 12:35 PM Matthias Klose <doko@ubuntu.com> wrote:
>
> On 28.04.22 11:46, Nick Clifton via Binutils wrote:
> > Hi Guys,
> >
> >    OK, attached is v2 of my proposed patch.  The main features of this
> >    new version are:
> >
> >      * There are now configure options which can turn off the generation
> >        of linker warnings about the creation of executable segments and
> >        the creation of executable stacks.  By default however not using
> >        these configure options will result in the creation of a linker
> >        with all of the warnings enabled.
> >
> >      * There is new linker command line option: --no-warn-rwx-segments
> >        which disables the warnings about executable segments.
> >
> >      * There are tests for the new features, plus extra regexps in the
> >        testsuite's pruning proc to remove the warnings from the linker's
> >        output for normal tests.
> >
> >      * The creation of a TLS segment with eXecute permission will trigger
> >        a warning, regardless of whether it has the read and/or write
> >        permissions set.
> >
> >      * There is a new configure time option which will disable the
> >        creation of an executable stack simply because an input file is
> >        missing a .note-GNU-stack section (for those architectures where
> >        such a creation is the normal behaviour).  This option is not
> >        enabled by default however.  At least not yet.
> >
> >    I think that this represents the best compromise between helping to
> >    promote secure builds whilst also allowing toolchain creators and
> >    program builders the option to disable the features if they wish.
> >
> >    Any comments ?
>
> this commit contains a ld/aclocal.m4 generated with automake 1.16.  Please
> re-create that file with automake 1.15.1. And maybe re-create the Makefile.in
> also with the correct automake version.
>
> Thanks, Matthias

I am checking in this.

-- 
H.J.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-ld-Regenerate-aclocal.m4-with-automake-1.15.1.patch
Type: text/x-patch
Size: 16758 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20220503/c917d777/attachment-0001.bin>