buglibffcall - foreign function call libraries - Bugs: bug #30273, Executeable stack not necessary

 
 

bug #30273: Executeable stack not necessary

Submitter:  Christoph Egger <christoph_egger>
Submitted:  Sun 27 Jun 2010 06:52:49 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fix Released
Privacy:  Public Assigned to:  haible
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 10 Jun 2017 12:43:35 PM UTC, comment #3: 

You weren't clear enough when you said "stacks marked executeable ... [have] negative impact on SELinux systems". It made me think that it would lead to errors or severe warning messages.

Actually, the effect is - and not only on SELinux systems, but on all Linux distros - that the security is reduced, because it is easier for attackers to invade a system when they can put executable instructions on the stack.

This has now been fixed in git:
http://git.savannah.gnu.org/gitweb/?p=libffcall.git;a=commit;h=f08e20fb6a6d3ae630a84dafc0ec7e0c9763ae26

Bruno Haible <haible>
Group administrator
Sat 11 Feb 2017 03:28:22 PM UTC, comment #2: 

In two months, I haven't seen any system that would require this
.section    .note.GNU-stack,"",@progbits
annotation in the .s files.

I've seen SELinux systems, e.g. CentOS 5.8, Fedora 1, Fedora 13, PowerPC64.
None had this problem.

It looks like the problem existed between ca. 2003 and 2011 in some setups but nowadays no SELinux system requires this.

Bruno Haible <haible>
Group administrator
Sun 27 Jun 2010 08:47:26 PM UTC, comment #1: 

Hi
what does "doesn't seem to be necessary" mean?
did you build clisp with the non-stack-executable libffcall?
does "make check" in clisp work?
Thanks!

Sam Steingold <sds>
Group administrator
Sun 27 Jun 2010 06:52:49 PM UTC, original submission:  

Hi!

libavcall and libcallback have both stacks marked executeable which has negative impact on SELinux systems and doesn't seem to be necessary.

See also http://bugs.debian.org/445895 as reference

Christoph Egger <christoph_egger>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Posted a comment)
  • -email is unavailable- added by sds (Posted a comment)
  • -email is unavailable- added by christoph_egger (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-01-04 haible StatusFixed Fix Released
    2017-06-10 haible StatusWorks For Me Fixed
    2017-02-11 haible StatusNone Works For Me
        Open/ClosedOpen Closed
    2010-06-27 sds Assigned toNone haible

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code