|author||Rich Felker <firstname.lastname@example.org>||2012-10-03 11:49:58 -0400|
|committer||Rich Felker <email@example.com>||2012-10-03 11:49:58 -0400|
tell the assembler to mark all files as not requiring executable stack
for some reason this option is undocumented. not sure when it was added, so I'm using a configure test. gcc was already setting the mark correctly for C files, but assembler source files would need ugly .note boilerplate in every single file to achieve this without the option to the assembler. blame whoever thought it would be a good idea to make the stack executable by default rather than doing it the other way around...
1 files changed, 7 insertions, 0 deletions
@@ -248,6 +248,13 @@ tryflag CFLAGS_AUTO -fno-unwind-tables
tryflag CFLAGS_AUTO -fno-asynchronous-unwind-tables
+# The GNU toolchain defaults to assuming unmarked files need an
+# executable stack, potentially exposing vulnerabilities in programs
+# linked with such object files. Fix this.
+tryflag CFLAGS_AUTO -Wa,--noexecstack
# Some optimization levels add bloated alignment that hurt performance
tryflag CFLAGS_AUTO -falign-functions=1