[PATCH v2 1/3] elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property

[Florian Weimer]

* Jan Beulich:

> On 30.09.2024 22:08, Adhemerval Zanella wrote:
>> Along with -Wl,memory-seal/-Wl,nomemory-seal options to ld.bfd.
>> 
>> The new attribute indicates that an ET_EXEC or ET_DYN ELF object should
>> be memory-sealed if the loader supports it. Memory sealing is useful as
>> a hardening mechanism to avoid either remapping the memory segments or
>> changing the memory protection segments layout by the dynamic loader
>> (for instance, the RELRO hardening). The Linux 6.10
>> (8be7258aad44b5e25977a98db136f677fa6f4370) added the mseal syscall
>> accomplishes it.
>> 
>> A GNU property is used instead of a new dynamic section tag (like the
>> one proposed for DT_GNU_FLAGS_1) because the memory sealing should be
>> selectable for ET_EXEC and not only for ET_DYN. It also fits new opt-in
>> security features like x86 CET or AArch64 BTI.
>
> What's wrong with DT_* in ET_EXEC type files? The first random executables
> I looked at (as-new and ld-new) have a fair set of DT_*, so I don't see
> why a note would need using instead. As per H.J.'s question, a note would
> also pose a possible issue (as to how to deal with it) when found in an
> object file.

Do we even need a new flag?  Could we reuse DF_1_NODELETE?

Thanks,
Florian