AIX : -bnorwexec linker flag

[Baesken, Matthias]

Hello,  I have a question regarding the  AIX  -bnorwexec linker flag .
I think it is related to an AIX  security feature  SED , see also  :

https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/stack_exec_disable_flags.htm

When building with the additional  -bnorwexec linker flag    we signal  the OS  that we "request"  the SED  feature .
Please compare  a patched  and an unpatched  java   ( patched is flagged "request"  while   unpatched uses the  "system" setting ).

bash-4.3$ sedmgr -d /patched_jdk/images/jdk/bin/java
/patched_jdk/images/images/jdk/bin/java : request


bash-4.3$ sedmgr -d /normal_jdk/images/jdk/bin/java
/normal_jdk/images/jdk/bin/java : system


System config on the example machine is "normal" (default) select :
bash-4.3$ sedmgr
Stack Execution Disable (SED) mode: select
SED configured in kernel: select


In our  internal tests  I noticed so far no issues when setting the  -bnorwexec linker flag  in OpenJDK  on AIX  .
Do you have any experience  with it, do you see issues when setting the flag ?


The documentation of the  flag is a bit short .


https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.cmds3/ld.htm


norwexec

Specifies that if the system's sed_config setting is not off, the process' private data areas will have non-execute permission.




Patch would be :

diff -r 0d7fb7f07134 make/autoconf/flags-ldflags.m4
--- a/make/autoconf/flags-ldflags.m4    Mon Apr 08 06:56:37 2019 +0100
+++ b/make/autoconf/flags-ldflags.m4 Mon Apr 08 10:50:07 2019 +0200
@@ -1,5 +1,5 @@
#
-# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
#
# This code is free software; you can redistribute it and/or modify it
@@ -88,7 +88,7 @@
     BASIC_LDFLAGS_JVM_ONLY="-library=%none -mt -z noversion"
   elif test "x$TOOLCHAIN_TYPE" = xxlc; then
-    BASIC_LDFLAGS="-b64 -brtl -bnolibpath -bexpall -bernotok -btextpsize:64K \
+    BASIC_LDFLAGS="-b64 -brtl -bnorwexec -bnolibpath -bexpall -bernotok -btextpsize:64K \
         -bdatapsize:64K -bstackpsize:64K"
     # libjvm.so has gotten too large for normal TOC size; compile with qpic=large and link with bigtoc
     BASIC_LDFLAGS_JVM_ONLY="-Wl,-lC_r -bbigtoc"


Best regards, Matthias