5 ms·

.note.GNU-stack (2010)

62 points by networked 10y ago

deleted 10y ago
[deleted]
userbinator 10y ago
Couldn't they have just used a bit in the header to indicate this, instead of requiring an entire section description (despite it being empty)? I believe there are some unused bits in ELF headers. I do RE so I've inspected many binaries, and my impression is that the amount of "GNU promotion", for lack of a better word, in ELFs seems much higher than what Windows' toolchains will do for PEs. "GNU-stack" is entirely non-descriptive; something like "NXstack" would make more sense to me. There are also lots of sections (even in a linked, executable binary), lots of text auxillary information that isn't used (but can offer thumbprinting/forensic opportunities --- or risks, depending on your perspective), and overall why!? design decisions like this one. Maybe it's just my bias because I started with PE, but I'm of the opinion that it's more straightforward than ELF --- especially some features like dynamic linking.
- sveiss 10y ago
  Claiming a header bit for this would require agreement from everyone creating/using ELF binaries. A magic section name is much less likely to run into conflicts. PE has the advantage of one vendor controlling the spec and the implementation used by the majority of binaries out there.
  - userbinator 10y ago
    In other words, it's the bureaucracy of the environment that's caused this? This is not uncommon amongst other file formats and implementations too, where those which were created by large organisations or multiple groups also tend to be the most complex ("design by committee"). Or alternatively, someone could just decide "let's use this bit, no one else seems to be", and everyone else who didn't think of the idea first can follow along.
    - the_why_of_y 10y ago
      But then you have a problem: because anybody could make use of some currently unused header bit, anybody else could at the same time decide to make use of the same bit for a totally different purpose, and chaos would ensue - therefore everybody has to be prudent and avoid creating such potential conflicts.
- geofft 10y ago
  "GNU" is a vendor prefix, not advertising. If you look at Solaris binaries, you'll see a lot of "SUNW". (And you'll occasionally see "SUNW" on GNU binaries for things that they adopted from Sun.) The ELF standard (which GNU does not control, as 'sveiss said) says this is what a note section is for: "Sometimes a vendor or system builder needs to mark an object file with special information that other programs will check for conformance, compatibility, etc. Sections of type SHT_NOTE and program header elements of type PT_NOTE can be used for this purpose. [...] There is no formal mechanism for avoiding name conflicts. By convention, vendors use their own name, such as 'XYZ Computer Company,' as the identifier." (If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.)
  - DSMan195276 10y ago
    > (If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.) The presence of that alone won't make the stack noexec, the status of the stack is determined by whether or not the `executable` flag is set on that section. So calling it the `stack` makes sense, since it in-effect just represents the stack itself, which isn't normally mentioned in the ELF binary.
  - fit2rule 10y ago
    Just by way of example, I've used .note sections in the past as a place to store such mundane things as checksum of the binary text segment, so that text-segment verification can occur before the binary is loaded (for safety-critical systems) .. its quite a useful section, as long as you know what you're looking for..
  - sigjuice 10y ago
    e.g. .SUNW_ctf https://illumos.org/man/4/ctf https://illumos.org/man/4/ctf
- jwilk 10y ago
  As a commenter noticed, it's not mere presence of the section that disables the stack executability. If the section have SHF_EXECINSTR flag enabled, the stack will be still executable. So actually the name of the section makes sense.
jwilk 10y ago
It's 503 for me, so here's an archived copy: https://archive.is/VchZA https://archive.is/VchZA
to3m 10y ago
Another note about .note.GNU-stack, from Ian Lance Tayler: http://www.airs.com/blog/archives/518 http://www.airs.com/blog/archives/518 He has a 20-part series on linkers that may also be of interest, though I suppose since they were written some of the details may have changed: Part 1: http://www.airs.com/blog/archives/38 http://www.airs.com/blog/archives/38 ; Part 2: http://www.airs.com/blog/archives/39 http://www.airs.com/blog/archives/39 ; Part 3: http://www.airs.com/blog/archives/40 http://www.airs.com/blog/archives/40 ; Part 4: http://www.airs.com/blog/archives/41 http://www.airs.com/blog/archives/41 ; Part 5: http://www.airs.com/blog/archives/42 http://www.airs.com/blog/archives/42 ; Part 6: http://www.airs.com/blog/archives/43 http://www.airs.com/blog/archives/43 ; Part 7: http://www.airs.com/blog/archives/44 http://www.airs.com/blog/archives/44 ; Part 8: http://www.airs.com/blog/archives/45 http://www.airs.com/blog/archives/45 ; Part 9: http://www.airs.com/blog/archives/46 http://www.airs.com/blog/archives/46 ; Part 10: http://www.airs.com/blog/archives/47 http://www.airs.com/blog/archives/47 ; Part 11: http://www.airs.com/blog/archives/48 http://www.airs.com/blog/archives/48 ; Part 12: http://www.airs.com/blog/archives/49 http://www.airs.com/blog/archives/49 ; Part 13: http://www.airs.com/blog/archives/50 http://www.airs.com/blog/archives/50 ; Part 14: http://www.airs.com/blog/archives/51 http://www.airs.com/blog/archives/51 ; Part 15: http://www.airs.com/blog/archives/52 http://www.airs.com/blog/archives/52 ; Part 16: http://www.airs.com/blog/archives/53 http://www.airs.com/blog/archives/53 ; Part 17: http://www.airs.com/blog/archives/54 http://www.airs.com/blog/archives/54 ; Part 18: http://www.airs.com/blog/archives/55 http://www.airs.com/blog/archives/55 ; Part 19: http://www.airs.com/blog/archives/56 http://www.airs.com/blog/archives/56 ; Part 20: http://www.airs.com/blog/archives/57 http://www.airs.com/blog/archives/57

62 points by networked 10y ago

deleted 10y ago

[deleted]

Couldn't they have just used a bit in the header to indicate this, instead of requiring an entire section description (despite it being empty)? I believe there are some unused bits in ELF headers. I do RE so I've inspected many binaries, and my impression is that the amount of "GNU promotion", for lack of a better word, in ELFs seems much higher than what Windows' toolchains will do for PEs. "GNU-stack" is entirely non-descriptive; something like "NXstack" would make more sense to me. There are also lots of sections (even in a linked, executable binary), lots of text auxillary information that isn't used (but can offer thumbprinting/forensic opportunities --- or risks, depending on your perspective), and overall why!? design decisions like this one. Maybe it's just my bias because I started with PE, but I'm of the opinion that it's more straightforward than ELF --- especially some features like dynamic linking.

sveiss 10y ago
Claiming a header bit for this would require agreement from everyone creating/using ELF binaries. A magic section name is much less likely to run into conflicts. PE has the advantage of one vendor controlling the spec and the implementation used by the majority of binaries out there.
- userbinator 10y ago
  In other words, it's the bureaucracy of the environment that's caused this? This is not uncommon amongst other file formats and implementations too, where those which were created by large organisations or multiple groups also tend to be the most complex ("design by committee"). Or alternatively, someone could just decide "let's use this bit, no one else seems to be", and everyone else who didn't think of the idea first can follow along.
  - the_why_of_y 10y ago
    But then you have a problem: because anybody could make use of some currently unused header bit, anybody else could at the same time decide to make use of the same bit for a totally different purpose, and chaos would ensue - therefore everybody has to be prudent and avoid creating such potential conflicts.
geofft 10y ago
"GNU" is a vendor prefix, not advertising. If you look at Solaris binaries, you'll see a lot of "SUNW". (And you'll occasionally see "SUNW" on GNU binaries for things that they adopted from Sun.) The ELF standard (which GNU does not control, as 'sveiss said) says this is what a note section is for: "Sometimes a vendor or system builder needs to mark an object file with special information that other programs will check for conformance, compatibility, etc. Sections of type SHT_NOTE and program header elements of type PT_NOTE can be used for this purpose. [...] There is no formal mechanism for avoiding name conflicts. By convention, vendors use their own name, such as 'XYZ Computer Company,' as the identifier." (If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.)
- DSMan195276 10y ago
  > (If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.) The presence of that alone won't make the stack noexec, the status of the stack is determined by whether or not the `executable` flag is set on that section. So calling it the `stack` makes sense, since it in-effect just represents the stack itself, which isn't normally mentioned in the ELF binary.
- fit2rule 10y ago
  Just by way of example, I've used .note sections in the past as a place to store such mundane things as checksum of the binary text segment, so that text-segment verification can occur before the binary is loaded (for safety-critical systems) .. its quite a useful section, as long as you know what you're looking for..
- sigjuice 10y ago
  e.g. .SUNW_ctf https://illumos.org/man/4/ctf https://illumos.org/man/4/ctf
jwilk 10y ago
As a commenter noticed, it's not mere presence of the section that disables the stack executability. If the section have SHF_EXECINSTR flag enabled, the stack will be still executable. So actually the name of the section makes sense.

jwilk 10y ago

It's 503 for me, so here's an archived copy: https://archive.is/VchZA https://archive.is/VchZA

to3m 10y ago

Another note about .note.GNU-stack, from Ian Lance Tayler: http://www.airs.com/blog/archives/518 http://www.airs.com/blog/archives/518 He has a 20-part series on linkers that may also be of interest, though I suppose since they were written some of the details may have changed: Part 1: http://www.airs.com/blog/archives/38 http://www.airs.com/blog/archives/38 ; Part 2: http://www.airs.com/blog/archives/39 http://www.airs.com/blog/archives/39 ; Part 3: http://www.airs.com/blog/archives/40 http://www.airs.com/blog/archives/40 ; Part 4: http://www.airs.com/blog/archives/41 http://www.airs.com/blog/archives/41 ; Part 5: http://www.airs.com/blog/archives/42 http://www.airs.com/blog/archives/42 ; Part 6: http://www.airs.com/blog/archives/43 http://www.airs.com/blog/archives/43 ; Part 7: http://www.airs.com/blog/archives/44 http://www.airs.com/blog/archives/44 ; Part 8: http://www.airs.com/blog/archives/45 http://www.airs.com/blog/archives/45 ; Part 9: http://www.airs.com/blog/archives/46 http://www.airs.com/blog/archives/46 ; Part 10: http://www.airs.com/blog/archives/47 http://www.airs.com/blog/archives/47 ; Part 11: http://www.airs.com/blog/archives/48 http://www.airs.com/blog/archives/48 ; Part 12: http://www.airs.com/blog/archives/49 http://www.airs.com/blog/archives/49 ; Part 13: http://www.airs.com/blog/archives/50 http://www.airs.com/blog/archives/50 ; Part 14: http://www.airs.com/blog/archives/51 http://www.airs.com/blog/archives/51 ; Part 15: http://www.airs.com/blog/archives/52 http://www.airs.com/blog/archives/52 ; Part 16: http://www.airs.com/blog/archives/53 http://www.airs.com/blog/archives/53 ; Part 17: http://www.airs.com/blog/archives/54 http://www.airs.com/blog/archives/54 ; Part 18: http://www.airs.com/blog/archives/55 http://www.airs.com/blog/archives/55 ; Part 19: http://www.airs.com/blog/archives/56 http://www.airs.com/blog/archives/56 ; Part 20: http://www.airs.com/blog/archives/57 http://www.airs.com/blog/archives/57