On Tue, Jun 23, 2020 at 02:33:50PM -0700, Christian Kujau wrote:
> On Tue, 23 Jun 2020, Kees Cook wrote:
> > > $ checksec --format=json --extended --file=`which rsync` | jq
> > > {
> > > "/usr/bin/rsync": {
> > > "relro": "full",
> > > "canary": "yes",
> > > "nx": "no",
> > ^^^^^^^^^^^^^^^^^^
> >
> > It is, indeed, marked executable, it seems. What distro is this?
>
> Arch Linux (x86-64) with 5.6.5.a-1-hardened[0], running in a Xen DomU.
BTW this bug was exactly the one described in the changelog:
compiling assembly brings executable stack by default:
$ git-show 73faaab26d7db19ae6e04396a6e9d6372ed8e4ad
commit 73faaab26d7db19ae6e04396a6e9d6372ed8e4ad
Pass --noexecstack to assembler.
--- a/Makefile.in
+++ b/Makefile.in
@@ -135,7 +135,7 @@ simd-checksum-x86_64.o: simd-checksum-x86_64.cpp
$(CXX) -I. $(CXXFLAGS) $(CPPFLAGS) -c -o $@
$(srcdir)/simd-checksum-x86_64.cpp
lib/md5-asm-x86_64.o: lib/md5-asm-x86_64.S config.h lib/md-defines.h
- $(CC) -I. -c -o $@ $(srcdir)/lib/md5-asm-x86_64.S
+ $(CC) -I. -Wa,--noexecstack -c -o $@
$(srcdir)/lib/md5-asm-x86_64.S
