From 8b6a9202e7fb543d948efc20ff478d362665b945 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Sat, 10 Aug 2019 22:07:59 +0200 Subject: [PATCH] libressl: build libcrypto with noexecstack For some reasons, libcrypto would be built with the executable stack flag set. I found out about this when Nginx failed to load the shared library, because I was running it with MemoryDenyWriteExecute=true, which does not permit executable stacks. I am not sure why the stack ends up executable; the other shared libraries which are part of LibreSSL do not have this flag set. You can verify this with 'execstack -q'. Non-executable stacks should be the default, and from checking some other files, that does appear to be the case. The LibreSSL sources do not contain the string "execstack", so I am not sure what causes the default to be overridden. Adding '-z noexecstack' to the linker flags makes the linker unset the flag. Now my Nginx can load the library, and so far I have not run into other issues. --- pkgs/development/libraries/libressl/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index d710c41a97c..34262b89cd1 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -23,6 +23,10 @@ let rm configure ''; + # Ensure that the output libraries do not require an executable stack. + # Without this, libcrypto would be built with the executable stack flag set. + NIX_LDFLAGS = ["-z" "noexecstack"]; + enableParallelBuilding = true; outputs = [ "bin" "dev" "out" "man" "nc" ];