contrib/devtools/security-check.py
def check_ELF_RELRO(executable) -> bool:
    '''
    Check for read-only relocations.
    GNU_RELRO program header must exist
    Dynamic section must have BIND_NOW flag
    '''
    elf = pixie.load(executable)
    have_gnu_relro = False
    for ph in elf.program_headers:
        # Note: not checking p_flags == PF_R: here as linkers set the permission differently
        # This does not affect security: the permission flags of the GNU_RELRO program
        # header are ignored, the PT_LOAD header determines the effective permissions.
        # However, the dynamic linker need to write to this area so these are RW.
        # Glibc itself takes care of mprotecting this area R after relocations are finished.
        # See also https://marc.info/?l=binutils&m=1498883354122353
        if ph.p_type == pixie.PT_GNU_RELRO:
            have_gnu_relro = True

    have_bindnow = False
    for flags in elf.query_dyn_tags(pixie.DT_FLAGS):
        assert isinstance(flags, int)
        if flags & pixie.DF_BIND_NOW:
            have_bindnow = True

    return have_gnu_relro and have_bindnow

    Check for read-only relocations.
    GNU_RELRO program header must exist
    Dynamic section must have BIND_NOW flag
    
Check for read-only relocations.
GNU_RELRO program header must exist
Dynamic section must have BIND_NOW flag
Check for read - only relocations . GNU_RELRO program header must exist Dynamic section must have BIND_NOW flag
def check_ELF_RELRO(executable) -> bool:
    elf = pixie.load(executable)
    have_gnu_relro = False
    for ph in elf.program_headers:
        if ph.p_type == pixie.PT_GNU_RELRO:
            have_gnu_relro = True
    have_bindnow = False
    for flags in elf.query_dyn_tags(pixie.DT_FLAGS):
        assert isinstance(flags, int)
        if flags & pixie.DF_BIND_NOW:
            have_bindnow = True
    return have_gnu_relro and have_bindnow
def check_ELF_RELRO ( executable ) -> bool : elf = pixie . load ( executable ) have_gnu_relro = False for ph in elf . program_headers : if ph . p_type == pixie . PT_GNU_RELRO : have_gnu_relro = True have_bindnow = False for flags in elf . query_dyn_tags ( pixie . DT_FLAGS ) : assert isinstance ( flags , int ) if flags & pixie . DF_BIND_NOW : have_bindnow = True return have_gnu_relro and have_bindnow
Check for read-only relocations.
Check for read - only relocations .
'''
    Check for read-only relocations.
    GNU_RELRO program header must exist
    Dynamic section must have BIND_NOW flag
    ''' # Note: not checking p_flags == PF_R: here as linkers set the permission differently # This does not affect security: the permission flags of the GNU_RELRO program # header are ignored, the PT_LOAD header determines the effective permissions. # However, the dynamic linker need to write to this area so these are RW. # Glibc itself takes care of mprotecting this area R after relocations are finished. # See also https://marc.info/?l=binutils&m=1498883354122353
executable