.note.GNU-stack (2010) | Hacker News Reader

.note.GNU-stack (2010)

en.chys.info

62 pointsnetworked11 comments

Couldn't they have just used a bit in the header to indicate this, instead of requiring an entire section description (despite it being empty)? I believe there are some unused bits in ELF headers.

I do RE so I've inspected many binaries, and my impression is that the amount of "GNU promotion", for lack of a better word, in ELFs seems much higher than what Windows' toolchains will do for PEs. "GNU-stack" is entirely non-descriptive; something like "NXstack" would make more sense to me. There are also lots of sections (even in a linked, executable binary), lots of text auxillary information that isn't used (but can offer thumbprinting/forensic opportunities --- or risks, depending on your perspective), and overall why!? design decisions like this one. Maybe it's just my bias because I started with PE, but I'm of the opinion that it's more straightforward than ELF --- especially some features like dynamic linking.

Claiming a header bit for this would require agreement from everyone creating/using ELF binaries. A magic section name is much less likely to run into conflicts.

PE has the advantage of one vendor controlling the spec and the implementation used by the majority of binaries out there.

In other words, it's the bureaucracy of the environment that's caused this? This is not uncommon amongst other file formats and implementations too, where those which were created by large organisations or multiple groups also tend to be the most complex ("design by committee").

Or alternatively, someone could just decide "let's use this bit, no one else seems to be", and everyone else who didn't think of the idea first can follow along.

But then you have a problem: because anybody could make use of some currently unused header bit, anybody else could at the same time decide to make use of the same bit for a totally different purpose, and chaos would ensue - therefore everybody has to be prudent and avoid creating such potential conflicts.

"GNU" is a vendor prefix, not advertising. If you look at Solaris binaries, you'll see a lot of "SUNW". (And you'll occasionally see "SUNW" on GNU binaries for things that they adopted from Sun.)

The ELF standard (which GNU does not control, as 'sveiss said) says this is what a note section is for:

"Sometimes a vendor or system builder needs to mark an object file with special information that other programs will check for conformance, compatibility, etc. Sections of type SHT_NOTE and program header elements of type PT_NOTE can be used for this purpose. [...] There is no formal mechanism for avoiding name conflicts. By convention, vendors use their own name, such as 'XYZ Computer Company,' as the identifier."

(If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.)

> (If you want to argue that they should have named it ".note.GNU-noexecstack", I wouldn't disagree.)

The presence of that alone won't make the stack noexec, the status of the stack is determined by whether or not the `executable` flag is set on that section. So calling it the `stack` makes sense, since it in-effect just represents the stack itself, which isn't normally mentioned in the ELF binary.

Just by way of example, I've used .note sections in the past as a place to store such mundane things as checksum of the binary text segment, so that text-segment verification can occur before the binary is loaded (for safety-critical systems) .. its quite a useful section, as long as you know what you're looking for..

e.g. .SUNW_ctf https://illumos.org/man/4/ctf

As a commenter noticed, it's not mere presence of the section that disables the stack executability. If the section have SHF_EXECINSTR flag enabled, the stack will be still executable. So actually the name of the section makes sense.

Another note about .note.GNU-stack, from Ian Lance Tayler: http://www.airs.com/blog/archives/518

He has a 20-part series on linkers that may also be of interest, though I suppose since they were written some of the details may have changed:

It's 503 for me, so here's an archived copy: https://archive.is/VchZA

Reply on news.ycombinator.com