Mark binários graváveis e executáveis no openBSD

Question

A partir do OpenBSD 6.0, a imposição obrigatória do W ^ X é implementada.

Os binários que precisam de permissão para violar esta regra podem ser marcados com o comando ld:

Identify W^X labelled binaries at execve(2) time based upon the WX_OPENBSD_WXNEEDED flag set by ld -zwxneeded.

Eu tentei:

    ld -b <binary> -zwxneeded
    ld <binary> -zwxneeded

    # ld -b sbcl -zwxneeded
    ld: no input files
    # ld sbcl -zwxneeded    
    sbcl: could not read symbols: File format not recognized

Eu tenho lido a man page do ld, mas não consigo descobrir a sintaxe correta para a E / S do arquivo para definir o sinalizador requerido. Qualquer ajuda / conselho é muito apreciada.

    

Answer 1

Encontrada a resposta depois de reler o guia de upgrade do openBSD, as opções de montagem do sistema de arquivos precisam ser ajustadas em fstab.

The wxallowed mount option. W^X is now strictly enforced by default; a program can only violate it if it is located on a filesystem mounted with the wxallowed mount(8) option. This allows the base system to be more secure as long as /usr/local is a separate filesystem.

The base system has no W^X-violating programs, but the ports tree contains quite a few: chromium, mono, node, gnome, libreoffice, jdk, zeal, etc. If you want to run any of these ports on a regular basis, you need to add wxallowed to the mount options for /usr/local in fstab(5), e.g.:

  01020304050607.h /usr/local ffs rw,nodev,wxallowed 1 2

Small disks may not have a separate partition for /usr/local. In that case, add wxallowed to the smallest partition containing it: /usr or /.

Starting a W^X-violating program from a partition without the wxallowed mount option will produce a core dump and the dmesg(8) will contain an entry such as soffice.bin(15529): mprotect W^X violation. You can temporarily allow W^X-violating ports by issuing mount -uo wxallowed /usr/local.