[PATCH] elf: Make non-executable stack disable by default

[Adhemerval Zanella Netto]

On 14/06/24 07:50, Florian Weimer wrote:
> * Adhemerval Zanella Netto:
> 
>> I don't complete agree, in both cases is a permanent transition to a
>> executable stack.  I had been almost 20 years since GNU_PT_STACK was
>> added to make nx-stack the default, I *really* think it is time we
>> really enforce this on glibc side.
> 
> Ehh, there are still valid use cases for executable stack.  I'd feel
> much more comfortable with getting rid of that nasty dlopen support
> code.  I expect that most of the deliberate uses of executable stack can
> already be detected when loading the main program.
> 
> It's also easy to scan all installed shared objects to make sure that
> they do not require an executable stack.

Binutils is now warning of the need of executable stacks [1] and gcc nested
function trampolines can now be heap based [2] (besides being a gcc-only
extension). You even have sent a patch [3] with the recommendation that 
"Ensure that all assembler or object input files have the recommended security 
markup, particularly for non-executable stack.", so it is surprises me
the reluctance of making non-executable the default behavior.

Besides, if user really wants and requires an executable stack he can just
disable noexecstack with the tunable.

[1] https://www.redhat.com/en/blog/linkers-warnings-about-executable-stacks-and-segments
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=28d8c680aaea46137170fef2bd1c6a98301518dc
[3] https://patchwork.sourceware.org/project/glibc/patch/87tthyfirn.fsf@oldenburg.str.redhat.com/