RFC: Turning executable stack warnings into errors

[Jan Beulich]

On 18.10.2023 12:57, Sam James wrote:
> Nick Clifton <nickc@redhat.com> writes:
> 
>> Hi Guys,
>>
>>   I am working on a patch to turn the linker's warning messages about
>>   executable stacks into errors.  My intent is to use this to force
>>   programs that currently do have an executable stack to either change
>>   or deliberately disable the errors from the linker.  The plan is to
>>   then use this feature to help improve the security of Fedora
>>   binaries.
> 
> Thanks for working on this, Nick. We've had our own QA warnings in
> Gentoo for a long time with scanelf from pax-utils and there's few
> packages remaining with any sort of issue like this - and those which
> remain are usually a JIT or similar and just need to opt-in (in fact,
> they might already be doing so - our check doesn't look for that, we
> have a custom mechanism to silence FPs, so..).
> 
> Making textrels an error by default has gone well for us as well
> (pretty small fallout given we were warning on it for a while
> downstream:
> https://bugs.gentoo.org/showdependencytree.cgi?id=911581&hide_resolved=0),
> so might be worth coming back to that soon.
> 
>>
>>   I realise that the --fatal-warnings option could basically do the same
>>   thing, but that might be problematic for builds where some linker
>>   warnings are inevitable and can be safely ignored.  Hence I decided on
>>   a new command line option instead.
>>   
>>   The patch currently has these features:
>>
>>   * The change is configurable, but not on by default.
> 
> I think this part is up to you but it's easier if it's on by default for
> two reasons:
> 1) It's confusing if some distributions decide to turn it on and some
> don't (and it makes life easier for distributions if upstreams are more
> likely to be building with a version which has it on - both for bug
> reports & having this stuff get fixed);

I'm actually in favor of it being default-off. I'm building a number of
older versions of OS-kernel-like things, and having to patch them more
than absolutely necessary is undesirable (despite linking being quite
verbose due to the warnings, I've avoided such patching till now).
Nevertheless I could of course cope, if need be (and the same would
likely apply to others who find themselves in a similar position).

Jan