Thanks ! Let's see what other AIX developers say about it . Best regards, Matthias
-----Original Message----- From: Erik Joelsson <erik.joelsson@oracle.com> Sent: Freitag, 12. April 2019 15:30 To: Baesken, Matthias <matthias.baesken@sap.com>; ppc-aix-port- dev@openjdk.java.net; 'build-dev@openjdk.java.net' <build- dev@openjdk.java.net> Subject: Re: AIX : -bnorwexec linker flag
From a build point of view, the patch looks good. I cannot comment on the validity of adding the flag though.
/Erik
On 2019-04-12 02:15, Baesken, Matthias wrote:
Hello, I have a question regarding the AIX -bnorwexec linker flag . I think it is related to an AIX security feature SED , see also :
https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm. aix.security/stack_exec_disable_flags.htm
When building with the additional -bnorwexec linker flag we signal the
OS that we "request" the SED feature .
Please compare a patched and an unpatched java ( patched is flagged "request" while unpatched uses the "system" setting ).
bash-4.3$ sedmgr -d /patched_jdk/images/jdk/bin/java /patched_jdk/images/images/jdk/bin/java : request
bash-4.3$ sedmgr -d /normal_jdk/images/jdk/bin/java /normal_jdk/images/jdk/bin/java : system
System config on the example machine is "normal" (default) select : bash-4.3$ sedmgr Stack Execution Disable (SED) mode: select SED configured in kernel: select
In our internal tests I noticed so far no issues when setting the - bnorwexec linker flag in OpenJDK on AIX . Do you have any experience with it, do you see issues when setting the flag ?
The documentation of the flag is a bit short .
https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm. aix.cmds3/ld.htm
norwexec
Specifies that if the system's sed_config setting is not off, the process'
private data areas will have non-execute permission.
Patch would be :
diff -r 0d7fb7f07134 make/autoconf/flags-ldflags.m4 --- a/make/autoconf/flags-ldflags.m4 Mon Apr 08 06:56:37 2019 +0100 +++ b/make/autoconf/flags-ldflags.m4 Mon Apr 08 10:50:07 2019 +0200 @@ -1,5 +1,5 @@ # -# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved. +# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved. # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. # # This code is free software; you can redistribute it and/or modify it @@ -88,7 +88,7 @@ BASIC_LDFLAGS_JVM_ONLY="-library=%none -mt -z noversion" elif test "x$TOOLCHAIN_TYPE" = xxlc; then - BASIC_LDFLAGS="-b64 -brtl -bnolibpath -bexpall -bernotok -
btextpsize:64K \
+ BASIC_LDFLAGS="-b64 -brtl -bnorwexec -bnolibpath -bexpall -bernotok -btextpsize:64K \ -bdatapsize:64K -bstackpsize:64K" # libjvm.so has gotten too large for normal TOC size; compile with qpic=large and link with bigtoc BASIC_LDFLAGS_JVM_ONLY="-Wl,-lC_r -bbigtoc"
Best regards, Matthias