AIX : -bnorwexec linker flag
matthias.baesken at sap.com
Fri Apr 12 13:47:06 UTC 2019
Let's see what other AIX developers say about it .
Best regards, Matthias
> -----Original Message-----
> From: Erik Joelsson <erik.joelsson at oracle.com>
> Sent: Freitag, 12. April 2019 15:30
> To: Baesken, Matthias <matthias.baesken at sap.com>; ppc-aix-port-
> dev at openjdk.java.net; 'build-dev at openjdk.java.net' <build-
> dev at openjdk.java.net>
> Subject: Re: AIX : -bnorwexec linker flag
> From a build point of view, the patch looks good. I cannot comment on
> the validity of adding the flag though.
> On 2019-04-12 02:15, Baesken, Matthias wrote:
> > Hello, I have a question regarding the AIX -bnorwexec linker flag .
> > I think it is related to an AIX security feature SED , see also :
> > When building with the additional -bnorwexec linker flag we signal the
> OS that we "request" the SED feature .
> > Please compare a patched and an unpatched java ( patched is flagged
> "request" while unpatched uses the "system" setting ).
> > bash-4.3$ sedmgr -d /patched_jdk/images/jdk/bin/java
> > /patched_jdk/images/images/jdk/bin/java : request
> > bash-4.3$ sedmgr -d /normal_jdk/images/jdk/bin/java
> > /normal_jdk/images/jdk/bin/java : system
> > System config on the example machine is "normal" (default) select :
> > bash-4.3$ sedmgr
> > Stack Execution Disable (SED) mode: select
> > SED configured in kernel: select
> > In our internal tests I noticed so far no issues when setting the -
> bnorwexec linker flag in OpenJDK on AIX .
> > Do you have any experience with it, do you see issues when setting the
> flag ?
> > The documentation of the flag is a bit short .
> > norwexec
> > Specifies that if the system's sed_config setting is not off, the process'
> private data areas will have non-execute permission.
> > Patch would be :
> > diff -r 0d7fb7f07134 make/autoconf/flags-ldflags.m4
> > --- a/make/autoconf/flags-ldflags.m4 Mon Apr 08 06:56:37 2019 +0100
> > +++ b/make/autoconf/flags-ldflags.m4 Mon Apr 08 10:50:07 2019 +0200
> > @@ -1,5 +1,5 @@
> > #
> > -# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
> > +# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
> > # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
> > #
> > # This code is free software; you can redistribute it and/or modify it
> > @@ -88,7 +88,7 @@
> > BASIC_LDFLAGS_JVM_ONLY="-library=%none -mt -z noversion"
> > elif test "x$TOOLCHAIN_TYPE" = xxlc; then
> > - BASIC_LDFLAGS="-b64 -brtl -bnolibpath -bexpall -bernotok -
> btextpsize:64K \
> > + BASIC_LDFLAGS="-b64 -brtl -bnorwexec -bnolibpath -bexpall -bernotok
> -btextpsize:64K \
> > -bdatapsize:64K -bstackpsize:64K"
> > # libjvm.so has gotten too large for normal TOC size; compile with
> qpic=large and link with bigtoc
> > BASIC_LDFLAGS_JVM_ONLY="-Wl,-lC_r -bbigtoc"
> > Best regards, Matthias
More information about the build-dev