Tue, 16 Jan 2018 04:20:19 -0500
8187045: [linux] Not all libraries in the VM are linked with -z,noexecstack
Reviewed-by: dholmes, erikj
1.1 --- a/agent/src/os/linux/Makefile Mon Jan 22 13:29:02 2018 -0800 1.2 +++ b/agent/src/os/linux/Makefile Tue Jan 16 04:20:19 2018 -0500 1.3 @@ -1,5 +1,5 @@ 1.4 # 1.5 -# Copyright (c) 2002, 2012, Oracle and/or its affiliates. All rights reserved. 1.6 +# Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved. 1.7 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 1.8 # 1.9 # This code is free software; you can redistribute it and/or modify it 1.10 @@ -76,6 +76,9 @@ 1.11 endif 1.12 LFLAGS_LIBSA += $(LDFLAGS_HASH_STYLE) 1.13 1.14 +LDFLAGS_NO_EXEC_STACK="-Wl,-z,noexecstack" 1.15 +LFLAGS_LIBSA += $(LDFLAGS_NO_EXEC_STACK) 1.16 + 1.17 $(LIBSA): $(ARCH) $(OBJS) mapfile 1.18 $(GCC) -shared $(LFLAGS_LIBSA) -o $(LIBSA) $(OBJS) $(LIBS) 1.19
2.1 --- a/make/linux/makefiles/gcc.make Mon Jan 22 13:29:02 2018 -0800 2.2 +++ b/make/linux/makefiles/gcc.make Tue Jan 16 04:20:19 2018 -0500 2.3 @@ -1,5 +1,5 @@ 2.4 # 2.5 -# Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved. 2.6 +# Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved. 2.7 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 2.8 # 2.9 # This code is free software; you can redistribute it and/or modify it 2.10 @@ -303,6 +303,8 @@ 2.11 2.12 LFLAGS += $(LDFLAGS_HASH_STYLE) 2.13 2.14 +LDFLAGS_NO_EXEC_STACK="-Wl,-z,noexecstack" 2.15 + 2.16 # Use $(MAPFLAG:FILENAME=real_file_name) to specify a map file. 2.17 MAPFLAG = -Xlinker --version-script=FILENAME 2.18
3.1 --- a/make/linux/makefiles/jsig.make Mon Jan 22 13:29:02 2018 -0800 3.2 +++ b/make/linux/makefiles/jsig.make Tue Jan 16 04:20:19 2018 -0500 3.3 @@ -1,5 +1,5 @@ 3.4 # 3.5 -# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved. 3.6 +# Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved. 3.7 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 3.8 # 3.9 # This code is free software; you can redistribute it and/or modify it 3.10 @@ -44,7 +44,7 @@ 3.11 # cause problems with interposing. See CR: 6466665 3.12 # LFLAGS_JSIG += $(MAPFLAG:FILENAME=$(LIBJSIG_MAPFILE)) 3.13 3.14 -LFLAGS_JSIG += -D_GNU_SOURCE -D_REENTRANT $(LDFLAGS_HASH_STYLE) 3.15 +LFLAGS_JSIG += -D_GNU_SOURCE -D_REENTRANT $(LDFLAGS_HASH_STYLE) $(LDFLAGS_NO_EXEC_STACK) 3.16 3.17 # DEBUG_BINARIES overrides everything, use full -g debug information 3.18 ifeq ($(DEBUG_BINARIES), true)
4.1 --- a/src/share/vm/prims/whitebox.cpp Mon Jan 22 13:29:02 2018 -0800 4.2 +++ b/src/share/vm/prims/whitebox.cpp Tue Jan 16 04:20:19 2018 -0500 4.3 @@ -1,5 +1,5 @@ 4.4 /* 4.5 - * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved. 4.6 + * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved. 4.7 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4.8 * 4.9 * This code is free software; you can redistribute it and/or modify it 4.10 @@ -158,6 +158,9 @@ 4.11 } 4.12 WB_END 4.13 4.14 +#ifdef LINUX 4.15 +#include "utilities/elfFile.hpp" 4.16 +#endif 4.17 4.18 WB_ENTRY(jlong, WB_GetCompressedOopsMaxHeapSize(JNIEnv* env, jobject o)) { 4.19 return (jlong)Arguments::max_heap_for_compressed_oops(); 4.20 @@ -1010,6 +1013,21 @@ 4.21 } 4.22 } 4.23 4.24 +// Checks that the library libfile has the noexecstack bit set. 4.25 +WB_ENTRY(jboolean, WB_CheckLibSpecifiesNoexecstack(JNIEnv* env, jobject o, jstring libfile)) 4.26 + jboolean ret = false; 4.27 +#ifdef LINUX 4.28 + // Can't be in VM when we call JNI. 4.29 + ThreadToNativeFromVM ttnfv(thread); 4.30 + const char* lf = env->GetStringUTFChars(libfile, NULL); 4.31 + CHECK_JNI_EXCEPTION_(env, 0); 4.32 + ElfFile ef(lf); 4.33 + ret = (jboolean) ef.specifies_noexecstack(); 4.34 + env->ReleaseStringUTFChars(libfile, lf); 4.35 +#endif 4.36 + return ret; 4.37 +WB_END 4.38 + 4.39 #define CC (char*) 4.40 4.41 static JNINativeMethod methods[] = { 4.42 @@ -1121,6 +1139,8 @@ 4.43 (void*)&WB_GetNMethod }, 4.44 {CC"isMonitorInflated", CC"(Ljava/lang/Object;)Z", (void*)&WB_IsMonitorInflated }, 4.45 {CC"forceSafepoint", CC"()V", (void*)&WB_ForceSafepoint }, 4.46 + {CC"checkLibSpecifiesNoexecstack", CC"(Ljava/lang/String;)Z", 4.47 + (void*)&WB_CheckLibSpecifiesNoexecstack}, 4.48 }; 4.49 4.50 #undef CC
5.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 5.2 +++ b/test/runtime/execstack/TestCheckJDK.java Tue Jan 16 04:20:19 2018 -0500 5.3 @@ -0,0 +1,67 @@ 5.4 +/* 5.5 + * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved. 5.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 5.7 + * 5.8 + * This code is free software; you can redistribute it and/or modify it 5.9 + * under the terms of the GNU General Public License version 2 only, as 5.10 + * published by the Free Software Foundation. 5.11 + * 5.12 + * This code is distributed in the hope that it will be useful, but WITHOUT 5.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 5.14 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 5.15 + * version 2 for more details (a copy is included in the LICENSE file that 5.16 + * accompanied this code). 5.17 + * 5.18 + * You should have received a copy of the GNU General Public License version 5.19 + * 2 along with this work; if not, write to the Free Software Foundation, 5.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 5.21 + * 5.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 5.23 + * or visit www.oracle.com if you need additional information or have any 5.24 + * questions. 5.25 + */ 5.26 + 5.27 +/** 5.28 + * @test Testexecstack.java 5.29 + * @summary Searches for all libraries in test VM and checks that they 5.30 + * have the noexecstack bit set. 5.31 + * @requires (os.family == "linux") 5.32 + * @library /testlibrary /testlibrary/whitebox 5.33 + * @build sun.hotspot.WhiteBox 5.34 + * @run driver ClassFileInstaller sun.hotspot.WhiteBox 5.35 + * sun.hotspot.WhiteBox$WhiteBoxPermission 5.36 + * @run main/othervm -Xbootclasspath/a:. -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI 5.37 + * TestCheckJDK 5.38 + */ 5.39 + 5.40 +import com.oracle.java.testlibrary.Asserts; 5.41 +import sun.hotspot.WhiteBox; 5.42 + 5.43 +import java.nio.file.Files; 5.44 +import java.nio.file.Path; 5.45 +import java.nio.file.Paths; 5.46 + 5.47 +public class TestCheckJDK { 5.48 + static boolean testPassed = true; 5.49 + private static final WhiteBox WB = WhiteBox.getWhiteBox(); 5.50 + 5.51 + static void checkExecStack(Path file) { 5.52 + String filename = file.toString(); 5.53 + if (filename.endsWith(".so")) { 5.54 + if (!WB.checkLibSpecifiesNoexecstack(filename)) { 5.55 + System.out.println("Library does not have the noexecstack bit set: " + filename); 5.56 + testPassed = false; 5.57 + } 5.58 + } 5.59 + } 5.60 + 5.61 + public static void main(String[] args) throws Throwable { 5.62 + String vmInstallDir = System.getProperty("java.home"); 5.63 + 5.64 + Files.walk(Paths.get(vmInstallDir)).filter(Files::isRegularFile).forEach(TestCheckJDK::checkExecStack); 5.65 + 5.66 + Asserts.assertTrue(testPassed, 5.67 + "The tested VM contains libs that don't have the noexecstack " + 5.68 + "bit set. They must be linked with -z,noexecstack."); 5.69 + } 5.70 +}
6.1 --- a/test/testlibrary/whitebox/sun/hotspot/WhiteBox.java Mon Jan 22 13:29:02 2018 -0800 6.2 +++ b/test/testlibrary/whitebox/sun/hotspot/WhiteBox.java Tue Jan 16 04:20:19 2018 -0500 6.3 @@ -1,5 +1,5 @@ 6.4 /* 6.5 - * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved. 6.6 + * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved. 6.7 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 6.8 * 6.9 * This code is free software; you can redistribute it and/or modify it 6.10 @@ -235,4 +235,7 @@ 6.11 6.12 // Class Data Sharing 6.13 public native boolean isSharedClass(Class<?> c); 6.14 + 6.15 + // Returns true on linux if library has the noexecstack flag set. 6.16 + public native boolean checkLibSpecifiesNoexecstack(String libfilename); 6.17 }