| With latest versions of glibc, a lot of apps failed on a PaX enabled |
| system with: |
| cannot enable executable stack as shared object requires: Permission denied |
| |
| This is due to PaX 'exec-protecting' the stack, and ld.so then trying |
| to make the stack executable due to some libraries not containing the |
| PT_GNU_STACK section. Bug #32960. <azarah@gentoo.org> (12 Nov 2003). |
| |
| Patch also NPTL. Bug #116086. <kevquinn@gentoo.org> (20 Dec 2005). |
| |
| diff -durN glibc-2.10.1.orig/nptl/allocatestack.c glibc-2.10.1/nptl/allocatestack.c |
| --- glibc-2.10.1.orig/nptl/allocatestack.c 2009-01-29 21:34:16.000000000 +0100 |
| +++ glibc-2.10.1/nptl/allocatestack.c 2009-11-13 00:50:33.000000000 +0100 |
| @@ -326,7 +326,8 @@ |
| # error "Define either _STACK_GROWS_DOWN or _STACK_GROWS_UP" |
| #endif |
| if (mprotect (stack, len, PROT_READ | PROT_WRITE | PROT_EXEC) != 0) |
| - return errno; |
| + if (errno != EACCES) /* PAX is enabled */ |
| + return errno; |
| |
| return 0; |
| } |
| diff -durN glibc-2.10.1.orig/sysdeps/unix/sysv/linux/dl-execstack.c glibc-2.10.1/sysdeps/unix/sysv/linux/dl-execstack.c |
| --- glibc-2.10.1.orig/sysdeps/unix/sysv/linux/dl-execstack.c 2006-01-08 09:21:15.000000000 +0100 |
| +++ glibc-2.10.1/sysdeps/unix/sysv/linux/dl-execstack.c 2009-11-13 00:50:33.000000000 +0100 |
| @@ -63,7 +63,10 @@ |
| else |
| # endif |
| { |
| - result = errno; |
| + if (errno == EACCES) /* PAX is enabled */ |
| + result = 0; |
| + else |
| + result = errno; |
| goto out; |
| } |
| } |
| @@ -89,7 +92,12 @@ |
| page -= size; |
| else |
| { |
| - if (errno != ENOMEM) /* Unexpected failure mode. */ |
| + if (errno == EACCES) /* PAX is enabled */ |
| + { |
| + result = 0; |
| + goto out; |
| + } |
| + else if (errno != ENOMEM) /* Unexpected failure mode. */ |
| { |
| result = errno; |
| goto out; |
| @@ -115,7 +123,12 @@ |
| page += size; |
| else |
| { |
| - if (errno != ENOMEM) /* Unexpected failure mode. */ |
| + if (errno == EACCES) /* PAX is enabled */ |
| + { |
| + result = 0; |
| + goto out; |
| + } |
| + else if (errno != ENOMEM) /* Unexpected failure mode. */ |
| { |
| result = errno; |
| goto out; |