diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2023-02-21 09:16:29 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2023-02-21 20:51:47 +0100 |
| commit | 1eca770933e49a1be16e40bfbaefc0f75af81781 (patch) | |
| tree | 174920c45ead95d4a956727fc930aeee16d0a4a5 /src/boot | |
| parent | 6269ffe7ee8a659df7336a2582054ecd9eecf4b1 (diff) | |
| download | systemd-1eca770933e49a1be16e40bfbaefc0f75af81781.tar.gz | |
efi: drop executable-stack bit from .elf file
An rpminspect test in Fedora/RHEL is flagging our stub files as having an
executable stack. The check is correct:
$ readelf --wide --program-headers build/src/boot/efi/linuxx64.elf.stub | rg -i stack
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RWE 0x10
It seems to be just an omission in the linker script… None of the objects that
are linked into the stub are marked as requiring an executable stack:
$ readelf --wide --sections build/src/boot/efi/*.c.o \
/usr/lib/gnuefi/x64/libgnuefi.a \
/usr/lib/gnuefi/x64/libefi.a \
/usr/lib/gcc/x86_64-redhat-linux/12/libgcc.a \
| rg '.note.GNU-stack.*X'
(nothing)
On aarch64 we end up with a nonexecutable stack, but on ia32 and x64 we get one,
so this might be just a matter of defaults in the linker. It doesn't matter
greatly, but let's mark the stack as non-executable to avoid the warning.
Note: '-Wl,-z' is not needed, things work with just '-z'.
Diffstat (limited to 'src/boot')
| -rw-r--r-- | src/boot/efi/meson.build | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build index 380177449f..6c1934d9f1 100644 --- a/src/boot/efi/meson.build +++ b/src/boot/efi/meson.build @@ -257,6 +257,7 @@ efi_ldflags = [ '-Wl,--warn-common', '-Wl,-Bsymbolic', '-z', 'nocombreloc', + '-z', 'noexecstack', efi_crt0, ] |