Hello,  I have a question regarding the  AIX  -bnorwexec linker flag .

I think it is related to an AIX  security feature  SED , see also  :

https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/stack_exec_disable_flags.htm

When building with the additional  -bnorwexec linker flag    we signal  the OS  that we “request”  the SED  feature .

Please compare  a patched  and an unpatched  java   ( patched is flagged “request”  while   unpatched uses the  “system” setting ).

bash-4.3$ sedmgr -d /patched_jdk/images/jdk/bin/java

/patched_jdk/images/images/jdk/bin/java : request

bash-4.3$ sedmgr -d /normal_jdk/images/jdk/bin/java

/normal_jdk/images/jdk/bin/java : system

System config on the example machine is "normal" (default) select :

bash-4.3$ sedmgr

Stack Execution Disable (SED) mode: select

SED configured in kernel: select

In our  internal tests  I noticed so far no issues when setting the  -bnorwexec linker flag  in OpenJDK  on AIX  .

Do you have any experience  with it, do you see issues when setting the flag ?

The documentation of the  flag is a bit short .

https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.cmds3/ld.htm

norwexec

Specifies that if the system's sed_config setting is not off, the process' private data areas will have non-execute permission.

Patch would be :

diff -r 0d7fb7f07134 make/autoconf/flags-ldflags.m4

--- a/make/autoconf/flags-ldflags.m4    Mon Apr 08 06:56:37 2019 +0100

+++ b/make/autoconf/flags-ldflags.m4 Mon Apr 08 10:50:07 2019 +0200

@@ -1,5 +1,5 @@

#

-# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.

+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.

# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

#

# This code is free software; you can redistribute it and/or modify it

@@ -88,7 +88,7 @@

     BASIC_LDFLAGS_JVM_ONLY="-library=%none -mt -z noversion"

   elif test "x$TOOLCHAIN_TYPE" = xxlc; then

-    BASIC_LDFLAGS="-b64 -brtl -bnolibpath -bexpall -bernotok -btextpsize:64K \

+    BASIC_LDFLAGS="-b64 -brtl -bnorwexec -bnolibpath -bexpall -bernotok -btextpsize:64K \

         -bdatapsize:64K -bstackpsize:64K"

     # libjvm.so has gotten too large for normal TOC size; compile with qpic=large and link with bigtoc

     BASIC_LDFLAGS_JVM_ONLY="-Wl,-lC_r -bbigtoc"

Best regards, Matthias