gVisor doesn't support executable stacks or READ_IMPLIES_EXEC personality
Open
area: mm
exported
priority: p3
type: cleanup
type: enhancement
- Dominant language
- Go
- Stars
- 19.3k
- Forks
- 2k
- Avg merge
- 3d 5h
- Merged PRs (30d)
- 264
Description
Arguably this is a feature to stop insecure programs, but...
The prot flags of the ELF PT_GNU_STACK segment indicate whether or not the binary stack should be executable[1] and, by extension, whether all PROT_READs should be expanded to include PROT_EXEC[2].
If PT_GNU_STACK is omitted, Linux defaults to an executable stack. gVisor completely ignores this segment and never maps an executable stack.
[1] https://elixir.bootlin.com/linux/v5.0.4/source/fs/binfmt_elf.c#L810
[2] https://elixir.bootlin.com/linux/v5.0.4/source/fs/binfmt_elf.c#L877
Contributor guide
Assessment
This issue has not been assessed yet.