[PATCH v2 2/2] elf: Make non-executable stack disable by default

[Zack Weinberg]

On Fri, Jun 14, 2024, at 8:50 AM, Adhemerval Zanella wrote:
> It is past time to not allow executable stacks as default, even if
> kernel protection like SELinux already exists (although not widely
> deployed).  Binutils 2.39 now warns of the need of executable stacks
> by default [1] and gcc nested function trampolines can now be heap
> based [2] (besides being a gcc-only extension).

I want to be clear that I fully support disallowing executable stacks
by default, and, in fact, removing the code to support them.  If Florian
thinks we need a transition period, then I believe him, but I think
we should be loud and specific about the timeline toward complete
removal, and that timeline should be as short as possible.
Something like:

2.40:
  - executable stacks disabled for setuid binaries and dlopened
    modules, with no override
  - for non-setuid binaries, an executable stack will continue
    to be provided based on PT_GNU_EXECSTACK, but we only
    look at the main executable and its static dependencies
    for that annotation
  - tunable allows executable stacks to be turned off system-wide

2.41:
  - flip the default for the tunable: executable stacks are off
    system-wide but can be re-enabled (for binaries that request them)

2.43 (one year after the release of 2.41), assuming hurd and hppa-linux
have caught up:
  - all support code for executable stacks permanently removed

> For compatibility, a new tunable, glibc.rtld.noexecstack

Can we please call this tunable glibc.rtld.execstack instead of
glibc.rtld.noexecstack, with a value of 0 meaning executable
stacks are forbidden and 1 meaning they are allowed?  The double
negative is going to confuse people.

zw