[klibc] Latest kernel reports "process '/bin/sh' started with executable stack"

[Kees Cook]

On Fri, Feb 28, 2020 at 09:13:37PM +0000, Ben Hutchings wrote:
> On Tue, 2020-02-25 at 13:36 -0800, Kees Cook wrote:
> > On Thu, Feb 06, 2020 at 04:38:34PM +0100, Christophe Leroy wrote:
> [...]
> > > Indeed, the stack is rwx, which is unexpected. And it is the case for all
> > > klibc tools.
> > > 
> > > How can we fix that ?
> > 
> > klibc uses trampolines for its setjmp implementation. I ran into this
> > years ago when eradicating executable stacks from Ubuntu:
> > https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks
> 
> I've looked at all the setjmp() implementations and didn't spot any use
> of trampolines.

I last looked at this something like a decade ago, so perhaps it's
changed? If we can get klibc built without exec stack, that would be
lovely. (I still think the kernel change is a mistake, even if I really
do like the intent of it.)

-- 
Kees Cook