[PATCH] elf: Extend glibc.rtld.execstack tunable to force executable stack (BZ 32653)

[Adhemerval Zanella Netto]

On 10/02/25 16:29, Adhemerval Zanella wrote:
> From the bug report [1], multiple programs still require to dlopen
> shared libraries with either missing PT_GNU_STACK or with the executable
> bit set.  Although, in some cases, it seems to be a hard-craft assembly
> source without the required PT_GNU_STACK mark (so the loader is forced to
> set an RWE), other cases seem that the library uses trampolines [2].
> 
> Unfortunately, READ_IMPLIES_EXEC is not an option since on some ABIs
> (x86_64), the kernel clears the bit, making it unsupported.  To avoid
> reinstating the broken code that changes stack permission on dlopen
> (0ca8785a28), this patch extends the glibc.rtld.execstack tunable to
>  allow an option to force an executable stack at the program startup.
> 
> The tunable is a security issue because it defeats the PT_GNU_STACK
> hardening.  It has the slight advantage of making it explicit by the
> caller, and, as for other tunables, this is disabled for setuid binaries.
> A tunable also allows us to eventually remove it, but from previous
> experiences, it would require some time.
> 
> Checked on x86_64-linux-gnu and i686-linux-gnu.
> 
> [1] https://sourceware.org/bugzilla/show_bug.cgi?id=32653
> [2] https://github.com/conda-forge/ctng-compiler-activation-feedstock/issues/143

Sigh... I forgot to git add some file before sending the patch.  I will
sent a v2.