[PATCH v4 0/3] elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property

[Adhemerval Zanella]

elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property

The new GNU property is a way to mark binaries to be memory-sealed by
the loader, to avoid further changes of PT_LOAD segments (such as
unmapping or changing permission flags). This is done along with Linux
(the mseal syscall [1]), and C runtime supports to instruct the kernel
on the correct time to seal the mapping during program startup (for
instance, after RELRO setup).  This support is added along the glibc
support to handle the new gnu property [2].

The first patch adds the -Wl,memory-seal and -Wl,nomemory-seal optionsi
to ld.bfd. The GNU_PROPERTY_MEMORY_SEAL property is added only for
ET_EXEC or ET_DYN objects.

The second patch adds similar support for ld.gold.

The third patch adds the ld --enable-memory-seal configure option to
enable the memory sealing as default.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8be7258aad44b5e25977a98db136f677fa6f4370
[2] https://sourceware.org/pipermail/libc-alpha/2024-September/160291.html

Changes v3->v4:
* Rebase against master
* Address comments from last version

Changes v2->v3:
* Do not add or merge the GNU_PROPERTY_MEMORY_SEAL property if present
  on ET_REL.
* Extend testing.

Changes v1->v2:
* Make the security hardening opt-in instead of opt-out.
* Add gold support.

Adhemerval Zanella (3):
  elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property
  gold: Add GNU_PROPERTY_MEMORY_SEAL gnu property
  ld: Add --enable-memory-seal configure option

 bfd/elf-properties.c                       | 85 +++++++++++++++++-----
 bfd/elfxx-x86.c                            |  3 +-
 binutils/readelf.c                         |  6 ++
 binutils/testsuite/lib/binutils-common.exp | 22 ++++++
 elfcpp/elfcpp.h                            |  1 +
 gold/NEWS                                  |  3 +
 gold/layout.cc                             |  4 +
 gold/options.h                             |  3 +
 gold/testsuite/Makefile.am                 | 19 +++++
 gold/testsuite/Makefile.in                 | 26 ++++++-
 gold/testsuite/memory_seal_main.c          |  5 ++
 gold/testsuite/memory_seal_shared.c        |  7 ++
 gold/testsuite/memory_seal_test.sh         | 45 ++++++++++++
 include/bfdlink.h                          |  3 +
 include/elf/common.h                       |  1 +
 ld/NEWS                                    |  4 +
 ld/config.in                               |  3 +
 ld/configure                               | 38 ++++++++--
 ld/configure.ac                            | 17 +++++
 ld/emultempl/elf.em                        |  5 ++
 ld/ld.texi                                 |  8 ++
 ld/lexsup.c                                | 11 +++
 ld/testsuite/config/default.exp            |  8 ++
 ld/testsuite/ld-elf/property-seal-1.d      | 16 ++++
 ld/testsuite/ld-elf/property-seal-1.s      | 11 +++
 ld/testsuite/ld-elf/property-seal-2.d      | 17 +++++
 ld/testsuite/ld-elf/property-seal-3.d      | 16 ++++
 ld/testsuite/ld-elf/property-seal-4.d      | 16 ++++
 ld/testsuite/ld-elf/property-seal-5.d      | 15 ++++
 ld/testsuite/ld-elf/property-seal-6.d      | 16 ++++
 ld/testsuite/ld-elf/property-seal-7.d      | 14 ++++
 ld/testsuite/ld-elf/property-seal-8.d      | 15 ++++
 ld/testsuite/ld-srec/srec.exp              |  4 +
 ld/testsuite/lib/ld-lib.exp                |  6 ++
 34 files changed, 445 insertions(+), 28 deletions(-)
 create mode 100644 gold/testsuite/memory_seal_main.c
 create mode 100644 gold/testsuite/memory_seal_shared.c
 create mode 100755 gold/testsuite/memory_seal_test.sh
 create mode 100644 ld/testsuite/ld-elf/property-seal-1.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-1.s
 create mode 100644 ld/testsuite/ld-elf/property-seal-2.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-3.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-4.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-5.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-6.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-7.d
 create mode 100644 ld/testsuite/ld-elf/property-seal-8.d

-- 
2.43.0