AIX : -bnorwexec linker flag

[Baesken, Matthias]

Thanks !

Let's see what other AIX  developers say about it .

Best regards, Matthias


> -----Original Message-----
> From: Erik Joelsson <erik.joelsson at oracle.com>
> Sent: Freitag, 12. April 2019 15:30
> To: Baesken, Matthias <matthias.baesken at sap.com>; ppc-aix-port-
> dev at openjdk.java.net; 'build-dev at openjdk.java.net' <build-
> dev at openjdk.java.net>
> Subject: Re: AIX : -bnorwexec linker flag
> 
>  From a build point of view, the patch looks good. I cannot comment on
> the validity of adding the flag though.
> 
> /Erik
> 
> On 2019-04-12 02:15, Baesken, Matthias wrote:
> > Hello,  I have a question regarding the  AIX  -bnorwexec linker flag .
> > I think it is related to an AIX  security feature  SED , see also  :
> >
> >
> https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.
> aix.security/stack_exec_disable_flags.htm
> >
> > When building with the additional  -bnorwexec linker flag    we signal  the
> OS  that we "request"  the SED  feature .
> > Please compare  a patched  and an unpatched  java   ( patched is flagged
> "request"  while   unpatched uses the  "system" setting ).
> >
> > bash-4.3$ sedmgr -d /patched_jdk/images/jdk/bin/java
> > /patched_jdk/images/images/jdk/bin/java : request
> >
> >
> > bash-4.3$ sedmgr -d /normal_jdk/images/jdk/bin/java
> > /normal_jdk/images/jdk/bin/java : system
> >
> >
> > System config on the example machine is "normal" (default) select :
> > bash-4.3$ sedmgr
> > Stack Execution Disable (SED) mode: select
> > SED configured in kernel: select
> >
> >
> > In our  internal tests  I noticed so far no issues when setting the  -
> bnorwexec linker flag  in OpenJDK  on AIX  .
> > Do you have any experience  with it, do you see issues when setting the
> flag ?
> >
> >
> > The documentation of the  flag is a bit short .
> >
> >
> >
> https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.
> aix.cmds3/ld.htm
> >
> >
> > norwexec
> >
> > Specifies that if the system's sed_config setting is not off, the process'
> private data areas will have non-execute permission.
> >
> >
> >
> >
> > Patch would be :
> >
> > diff -r 0d7fb7f07134 make/autoconf/flags-ldflags.m4
> > --- a/make/autoconf/flags-ldflags.m4    Mon Apr 08 06:56:37 2019 +0100
> > +++ b/make/autoconf/flags-ldflags.m4 Mon Apr 08 10:50:07 2019 +0200
> > @@ -1,5 +1,5 @@
> > #
> > -# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
> > +# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
> > # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
> > #
> > # This code is free software; you can redistribute it and/or modify it
> > @@ -88,7 +88,7 @@
> >       BASIC_LDFLAGS_JVM_ONLY="-library=%none -mt -z noversion"
> >     elif test "x$TOOLCHAIN_TYPE" = xxlc; then
> > -    BASIC_LDFLAGS="-b64 -brtl -bnolibpath -bexpall -bernotok -
> btextpsize:64K \
> > +    BASIC_LDFLAGS="-b64 -brtl -bnorwexec -bnolibpath -bexpall -bernotok
> -btextpsize:64K \
> >           -bdatapsize:64K -bstackpsize:64K"
> >       # libjvm.so has gotten too large for normal TOC size; compile with
> qpic=large and link with bigtoc
> >       BASIC_LDFLAGS_JVM_ONLY="-Wl,-lC_r -bbigtoc"
> >
> >
> > Best regards, Matthias
> >