8187045: [linux] Not all libraries in the VM are linked with -z,noexecstack jdk8u162-b33

Tue, 16 Jan 2018 04:20:19 -0500

author
dbuck
date
Tue, 16 Jan 2018 04:20:19 -0500
changeset 9373
e8041f2ec96e
parent 9366
98a5bb995328
child 9374
bf2e8b1e8e8e

8187045: [linux] Not all libraries in the VM are linked with -z,noexecstack
Reviewed-by: dholmes, erikj

agent/src/os/linux/Makefile file | annotate | diff | comparison | revisions
make/linux/makefiles/gcc.make file | annotate | diff | comparison | revisions
make/linux/makefiles/jsig.make file | annotate | diff | comparison | revisions
src/share/vm/prims/whitebox.cpp file | annotate | diff | comparison | revisions
test/runtime/execstack/TestCheckJDK.java file | annotate | diff | comparison | revisions
test/testlibrary/whitebox/sun/hotspot/WhiteBox.java file | annotate | diff | comparison | revisions
     1.1 --- a/agent/src/os/linux/Makefile	Mon Jan 22 13:29:02 2018 -0800
     1.2 +++ b/agent/src/os/linux/Makefile	Tue Jan 16 04:20:19 2018 -0500
     1.3 @@ -1,5 +1,5 @@
     1.4  #
     1.5 -# Copyright (c) 2002, 2012, Oracle and/or its affiliates. All rights reserved.
     1.6 +# Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved.
     1.7  # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     1.8  #
     1.9  # This code is free software; you can redistribute it and/or modify it
    1.10 @@ -76,6 +76,9 @@
    1.11  endif
    1.12  LFLAGS_LIBSA += $(LDFLAGS_HASH_STYLE)
    1.13  
    1.14 +LDFLAGS_NO_EXEC_STACK="-Wl,-z,noexecstack"
    1.15 +LFLAGS_LIBSA += $(LDFLAGS_NO_EXEC_STACK)
    1.16 +
    1.17  $(LIBSA): $(ARCH) $(OBJS) mapfile
    1.18          $(GCC) -shared $(LFLAGS_LIBSA) -o $(LIBSA) $(OBJS) $(LIBS)
    1.19  
     2.1 --- a/make/linux/makefiles/gcc.make	Mon Jan 22 13:29:02 2018 -0800
     2.2 +++ b/make/linux/makefiles/gcc.make	Tue Jan 16 04:20:19 2018 -0500
     2.3 @@ -1,5 +1,5 @@
     2.4  #
     2.5 -# Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved.
     2.6 +# Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
     2.7  # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     2.8  #
     2.9  # This code is free software; you can redistribute it and/or modify it
    2.10 @@ -303,6 +303,8 @@
    2.11  
    2.12  LFLAGS += $(LDFLAGS_HASH_STYLE)
    2.13  
    2.14 +LDFLAGS_NO_EXEC_STACK="-Wl,-z,noexecstack"
    2.15 +
    2.16  # Use $(MAPFLAG:FILENAME=real_file_name) to specify a map file.
    2.17  MAPFLAG = -Xlinker --version-script=FILENAME
    2.18  
     3.1 --- a/make/linux/makefiles/jsig.make	Mon Jan 22 13:29:02 2018 -0800
     3.2 +++ b/make/linux/makefiles/jsig.make	Tue Jan 16 04:20:19 2018 -0500
     3.3 @@ -1,5 +1,5 @@
     3.4  #
     3.5 -# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
     3.6 +# Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved.
     3.7  # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     3.8  #
     3.9  # This code is free software; you can redistribute it and/or modify it
    3.10 @@ -44,7 +44,7 @@
    3.11  # cause problems with interposing. See CR: 6466665
    3.12  # LFLAGS_JSIG += $(MAPFLAG:FILENAME=$(LIBJSIG_MAPFILE))
    3.13  
    3.14 -LFLAGS_JSIG += -D_GNU_SOURCE -D_REENTRANT $(LDFLAGS_HASH_STYLE)
    3.15 +LFLAGS_JSIG += -D_GNU_SOURCE -D_REENTRANT $(LDFLAGS_HASH_STYLE) $(LDFLAGS_NO_EXEC_STACK)
    3.16  
    3.17  # DEBUG_BINARIES overrides everything, use full -g debug information
    3.18  ifeq ($(DEBUG_BINARIES), true)
     4.1 --- a/src/share/vm/prims/whitebox.cpp	Mon Jan 22 13:29:02 2018 -0800
     4.2 +++ b/src/share/vm/prims/whitebox.cpp	Tue Jan 16 04:20:19 2018 -0500
     4.3 @@ -1,5 +1,5 @@
     4.4  /*
     4.5 - * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved.
     4.6 + * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
     4.7   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     4.8   *
     4.9   * This code is free software; you can redistribute it and/or modify it
    4.10 @@ -158,6 +158,9 @@
    4.11  }
    4.12  WB_END
    4.13  
    4.14 +#ifdef LINUX
    4.15 +#include "utilities/elfFile.hpp"
    4.16 +#endif
    4.17  
    4.18  WB_ENTRY(jlong, WB_GetCompressedOopsMaxHeapSize(JNIEnv* env, jobject o)) {
    4.19    return (jlong)Arguments::max_heap_for_compressed_oops();
    4.20 @@ -1010,6 +1013,21 @@
    4.21    }
    4.22  }
    4.23  
    4.24 +// Checks that the library libfile has the noexecstack bit set.
    4.25 +WB_ENTRY(jboolean, WB_CheckLibSpecifiesNoexecstack(JNIEnv* env, jobject o, jstring libfile))
    4.26 +  jboolean ret = false;
    4.27 +#ifdef LINUX
    4.28 +  // Can't be in VM when we call JNI.
    4.29 +  ThreadToNativeFromVM ttnfv(thread);
    4.30 +  const char* lf = env->GetStringUTFChars(libfile, NULL);
    4.31 +  CHECK_JNI_EXCEPTION_(env, 0);
    4.32 +  ElfFile ef(lf);
    4.33 +  ret = (jboolean) ef.specifies_noexecstack();
    4.34 +  env->ReleaseStringUTFChars(libfile, lf);
    4.35 +#endif
    4.36 +  return ret;
    4.37 +WB_END
    4.38 +
    4.39  #define CC (char*)
    4.40  
    4.41  static JNINativeMethod methods[] = {
    4.42 @@ -1121,6 +1139,8 @@
    4.43                                                        (void*)&WB_GetNMethod         },
    4.44    {CC"isMonitorInflated",  CC"(Ljava/lang/Object;)Z", (void*)&WB_IsMonitorInflated  },
    4.45    {CC"forceSafepoint",     CC"()V",                   (void*)&WB_ForceSafepoint     },
    4.46 +  {CC"checkLibSpecifiesNoexecstack", CC"(Ljava/lang/String;)Z",
    4.47 +                                                      (void*)&WB_CheckLibSpecifiesNoexecstack},
    4.48  };
    4.49  
    4.50  #undef CC
     5.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.2 +++ b/test/runtime/execstack/TestCheckJDK.java	Tue Jan 16 04:20:19 2018 -0500
     5.3 @@ -0,0 +1,67 @@
     5.4 +/*
     5.5 + * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
     5.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     5.7 + *
     5.8 + * This code is free software; you can redistribute it and/or modify it
     5.9 + * under the terms of the GNU General Public License version 2 only, as
    5.10 + * published by the Free Software Foundation.
    5.11 + *
    5.12 + * This code is distributed in the hope that it will be useful, but WITHOUT
    5.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    5.14 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    5.15 + * version 2 for more details (a copy is included in the LICENSE file that
    5.16 + * accompanied this code).
    5.17 + *
    5.18 + * You should have received a copy of the GNU General Public License version
    5.19 + * 2 along with this work; if not, write to the Free Software Foundation,
    5.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
    5.21 + *
    5.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
    5.23 + * or visit www.oracle.com if you need additional information or have any
    5.24 + * questions.
    5.25 + */
    5.26 +
    5.27 +/**
    5.28 + * @test Testexecstack.java
    5.29 + * @summary Searches for all libraries in test VM and checks that they
    5.30 + *          have the noexecstack bit set.
    5.31 + * @requires (os.family == "linux")
    5.32 + * @library /testlibrary /testlibrary/whitebox
    5.33 + * @build sun.hotspot.WhiteBox
    5.34 + * @run driver ClassFileInstaller sun.hotspot.WhiteBox
    5.35 + *                                sun.hotspot.WhiteBox$WhiteBoxPermission
    5.36 + * @run main/othervm -Xbootclasspath/a:. -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI
    5.37 + *                   TestCheckJDK
    5.38 + */
    5.39 +
    5.40 +import com.oracle.java.testlibrary.Asserts;
    5.41 +import sun.hotspot.WhiteBox;
    5.42 +
    5.43 +import java.nio.file.Files;
    5.44 +import java.nio.file.Path;
    5.45 +import java.nio.file.Paths;
    5.46 +
    5.47 +public class TestCheckJDK {
    5.48 +    static boolean testPassed = true;
    5.49 +    private static final WhiteBox WB = WhiteBox.getWhiteBox();
    5.50 +
    5.51 +    static void checkExecStack(Path file) {
    5.52 +        String filename = file.toString();
    5.53 +        if (filename.endsWith(".so")) {
    5.54 +            if (!WB.checkLibSpecifiesNoexecstack(filename)) {
    5.55 +                System.out.println("Library does not have the noexecstack bit set: " + filename);
    5.56 +                testPassed = false;
    5.57 +            }
    5.58 +        }
    5.59 +    }
    5.60 +
    5.61 +    public static void main(String[] args) throws Throwable {
    5.62 +        String vmInstallDir = System.getProperty("java.home");
    5.63 +
    5.64 +        Files.walk(Paths.get(vmInstallDir)).filter(Files::isRegularFile).forEach(TestCheckJDK::checkExecStack);
    5.65 +
    5.66 +        Asserts.assertTrue(testPassed,
    5.67 +            "The tested VM contains libs that don't have the noexecstack " +
    5.68 +            "bit set. They must be linked with -z,noexecstack.");
    5.69 +    }
    5.70 +}
     6.1 --- a/test/testlibrary/whitebox/sun/hotspot/WhiteBox.java	Mon Jan 22 13:29:02 2018 -0800
     6.2 +++ b/test/testlibrary/whitebox/sun/hotspot/WhiteBox.java	Tue Jan 16 04:20:19 2018 -0500
     6.3 @@ -1,5 +1,5 @@
     6.4  /*
     6.5 - * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved.
     6.6 + * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
     6.7   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     6.8   *
     6.9   * This code is free software; you can redistribute it and/or modify it
    6.10 @@ -235,4 +235,7 @@
    6.11  
    6.12    // Class Data Sharing
    6.13    public native boolean isSharedClass(Class<?> c);
    6.14 +
    6.15 +  // Returns true on linux if library has the noexecstack flag set.
    6.16 +  public native boolean checkLibSpecifiesNoexecstack(String libfilename);
    6.17  }

mercurial