Add .note.GNU-stack at the source level.
GNU-based toolchains on ELF platforms default the stack to executable
and rely on a .note.GNU-stack section in *each* object file to flip it
off. The compiler knows to do this for its object files, but assembly
does everything by hand. See this link for details:
https://www.airs.com/blog/archives/518
We do this in the cmake build by passing -Wa,--noexecstack to the
assembler. However, since we have to deal with many buildsystems, it
would be more robust to put it in the source.
It's unclear whether this should be gated on ELF or Linux. The Gentoo
and Ubuntu documents recommend checking for Linux with gas, but only ELF
with NASM.
https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart
https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks
At the same time, these links suggest it is an ELF-wide issue and not
just Linux:
https://github.com/golang/go/issues/5392
https://reviews.freebsd.org/D11033
https://github.com/openssl/openssl/issues/4575 also discusses this but
the rationale lists both ELF and non-ELF platforms, so it's unclear.
Treat it as ELF-wide for now. We can revisit this if necessary.
Update-Note: If there is a build failure due to .note.GNU-stack, holler.
Change-Id: Ic59096aa1fc2bf5380a412c9991de22cb46c0faf
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37984
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/curve25519/asm/x25519-asm-arm.S b/crypto/curve25519/asm/x25519-asm-arm.S
index 905af07..9a26add 100644
--- a/crypto/curve25519/asm/x25519-asm-arm.S
+++ b/crypto/curve25519/asm/x25519-asm-arm.S
@@ -2129,4 +2129,8 @@
vpop {q4,q5,q6,q7}
bx lr
+#if defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
#endif /* !OPENSSL_NO_ASM && __arm__ && !__APPLE__ */
diff --git a/crypto/hrss/asm/poly_rq_mul.S b/crypto/hrss/asm/poly_rq_mul.S
index ebaabd3..0b684c3 100644
--- a/crypto/hrss/asm/poly_rq_mul.S
+++ b/crypto/hrss/asm/poly_rq_mul.S
@@ -8460,4 +8460,8 @@
.cfi_endproc
.size poly_Rq_mul,.-poly_Rq_mul
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
+
#endif
diff --git a/crypto/perlasm/arm-xlate.pl b/crypto/perlasm/arm-xlate.pl
index 4dec276..adbd239 100755
--- a/crypto/perlasm/arm-xlate.pl
+++ b/crypto/perlasm/arm-xlate.pl
@@ -228,6 +228,9 @@
print "\n";
}
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\%progbits\n" if ($flavour =~ /linux/);
+
print "#endif\n" if ($flavour eq "linux32" || $flavour eq "linux64");
print "#endif // !OPENSSL_NO_ASM\n";
diff --git a/crypto/perlasm/ppc-xlate.pl b/crypto/perlasm/ppc-xlate.pl
index 0ce231f..f8e42a2 100644
--- a/crypto/perlasm/ppc-xlate.pl
+++ b/crypto/perlasm/ppc-xlate.pl
@@ -309,6 +309,9 @@
print "\n";
}
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($flavour =~ /linux/);
+
print "#endif // !OPENSSL_NO_ASM && __powerpc64__\n";
close STDOUT;
diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl
index f928411..d2854cf 100755
--- a/crypto/perlasm/x86_64-xlate.pl
+++ b/crypto/perlasm/x86_64-xlate.pl
@@ -1260,6 +1260,8 @@
print "\n$current_segment\tENDS\n" if ($current_segment && $masm);
print "END\n" if ($masm);
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($elf);
print "#endif\n" if ($gas);
diff --git a/crypto/perlasm/x86asm.pl b/crypto/perlasm/x86asm.pl
index 24f0fc1..b331cd4 100644
--- a/crypto/perlasm/x86asm.pl
+++ b/crypto/perlasm/x86asm.pl
@@ -297,6 +297,8 @@
___
}
print @out;
+ # See https://www.airs.com/blog/archives/518.
+ print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($elf);
print "#endif\n" unless ($win32 || $netware);
}
diff --git a/crypto/poly1305/poly1305_arm_asm.S b/crypto/poly1305/poly1305_arm_asm.S
index 04f7c4c..77b3c48 100644
--- a/crypto/poly1305/poly1305_arm_asm.S
+++ b/crypto/poly1305/poly1305_arm_asm.S
@@ -2022,4 +2022,8 @@
add sp,sp,#0
bx lr
+#if defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
#endif /* __arm__ && !OPENSSL_NO_ASM && !__APPLE__ */
