[PATCH v3] elf: Extend glibc.rtld.execstack tunable to force executable stack (BZ 32653)

[Adhemerval Zanella Netto]

On 12/02/25 17:18, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>> --- a/manual/tunables.texi
>> +++ b/manual/tunables.texi
>> @@ -365,8 +365,11 @@ change the main stack permission if kernel starts with a non-executable stack.
>>  The @code{glibc.rtld.execstack} can be used to control whether an executable
>>  stack is allowed from the main program.  Setting the value to @code{0} disables
>>  the ABI auto-negotiation (meaning no executable stacks even if the ABI or ELF
>> -header requires it), while @code{1} enables auto-negotiation (although the
>> -program might not need an executable stack).
>> +header requires it), @code{1} enables auto-negotiation (although the program
>> +might not need an executable stack), while @code{2} forces and executable
> 
> forces an[] executable

Ack.

> 
>> +stack during initialization (this is provide for compatibility reasons, where
> 
> stack [at process start].  [T]his is provide[d] for compatibility[], [when]
> 

Ack.

>> +the program requires to dynamically load modules with executable stacks with
>> +@code{dlopen}).
> 
> the program dynamically loads modules with @code{dlopen} which require
> an executable stack.
> 

Ack.

>>  When executable stacks are not allowed, and if the main program requires it,
>>  the loader will fail with an error message.
>> @@ -380,7 +383,8 @@ of hardware capabilities and kernel configuration.
>>  @strong{NB:} Trying to load a dynamic shared library with @code{dlopen} or
>>  @code{dlmopen} that requires an executable stack will always fail if the
>>  main program does not require an executable stack at loading time.  This
>> -is enforced regardless of the tunable value.
>> +can be disable by setting the tunable to @code{2}, where the stack is
> 
> can be [worked around]

Ack.

> 
>> +always executable.
>>  @end deftp
> 
>> diff --git a/sysdeps/unix/sysv/linux/dl-execstack.c b/sysdeps/unix/sysv/linux/dl-execstack.c
>> index 9791b339ca..338c642040 100644
>> --- a/sysdeps/unix/sysv/linux/dl-execstack.c
>> +++ b/sysdeps/unix/sysv/linux/dl-execstack.c
>> @@ -17,6 +17,7 @@
>>     <https://www.gnu.org/licenses/>.  */
>>  
>>  #include <ldsodefs.h>
>> +#include <dl-tunables.h>
>>  
>>  int
>>  _dl_make_stack_executable (void **stack_endp)
> 
> Is this steal needed?

No, I will remove it.

> 
> Thanks,
> Florian
>