[PATCH v2 1/3] elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property

[Jan Beulich]

On 30.09.2024 22:08, Adhemerval Zanella wrote:
> Along with -Wl,memory-seal/-Wl,nomemory-seal options to ld.bfd.
> 
> The new attribute indicates that an ET_EXEC or ET_DYN ELF object should
> be memory-sealed if the loader supports it. Memory sealing is useful as
> a hardening mechanism to avoid either remapping the memory segments or
> changing the memory protection segments layout by the dynamic loader
> (for instance, the RELRO hardening). The Linux 6.10
> (8be7258aad44b5e25977a98db136f677fa6f4370) added the mseal syscall
> accomplishes it.
> 
> A GNU property is used instead of a new dynamic section tag (like the
> one proposed for DT_GNU_FLAGS_1) because the memory sealing should be
> selectable for ET_EXEC and not only for ET_DYN. It also fits new opt-in
> security features like x86 CET or AArch64 BTI.

What's wrong with DT_* in ET_EXEC type files? The first random executables
I looked at (as-new and ld-new) have a fair set of DT_*, so I don't see
why a note would need using instead. As per H.J.'s question, a note would
also pose a possible issue (as to how to deal with it) when found in an
object file.

Jan