[PATCH] elf: Make non-executable stack disable by default

[Zack Weinberg]

On Thu, Jun 13, 2024, at 10:44 AM, Florian Weimer wrote:
> * Adhemerval Zanella Netto:
>> On 13/06/24 02:55, Florian Weimer wrote:
>>> * Adhemerval Zanella:
>>> 
>>>> +* A new tunable, glibc.rtld.noexecstack, can be used to enable executable
>>>> +  stacks from either main program, dependencies, or dynamically loadeed
>>>> +  libraries.  The default is to disable executable stacks.
>>> 
>>> Typo: “load[e]d”
>>> 
>>> Should we refuse to enable executable stack on dlopen by default?  
>>
>> That's the idea of this change.
>>
>>> And
>>> only enable it if the initial set of objects request executable stack?
>>
>> No, I think we should only allow it if user explicit enables it with the
>> tunable.  Non-executable stack should not be allowed by silent dlopen a
>> bogus shared library.
>
> I think dlopen and initial executable are different scenarios.  It's
> much easier to disable dlopen support by default if we keep the initial
> execstack support present.

What if, instead of a boolean, 'glibc.rtld.execstack' can take these values:

  - allow:      current behavior (governed by .note.GNU-stack)
  - no-suid:    stack is always non-executable in suid binaries,
                still governed by .note.GNU-stack for others
  - no-dlopen:  .note.GNU-stack is ignored for dlopen() but
                still honored for initial set of objects
  - no-suid,no-dlopen / no-dlopen,no-suid:
                combine effects of no-suid and no-dlopen
  - forbid:     stack is never executable

with the default for 2.40 being no-suid,no-dlopen, and we declare
our intention to bump it to 'forbid' soon, and to drop support for
'allow' and 'no-suid' without 'no-dlopen' eventually.

zw