contrib/devtools/security-check.py
def check_ELF_separate_code(executable):
    '''
    Check that sections are appropriately separated in virtual memory,
    based on their permissions. This checks for missing -Wl,-z,separate-code
    and potentially other problems.
    '''
    elf = pixie.load(executable)
    R = pixie.PF_R
    W = pixie.PF_W
    E = pixie.PF_X
    EXPECTED_FLAGS = {
        # Read + execute
        b'.init': R | E,
        b'.plt': R | E,
        b'.plt.got': R | E,
        b'.plt.sec': R | E,
        b'.text': R | E,
        b'.fini': R | E,
        # Read-only data
        b'.interp': R,
        b'.note.gnu.property': R,
        b'.note.gnu.build-id': R,
        b'.note.ABI-tag': R,
        b'.gnu.hash': R,
        b'.dynsym': R,
        b'.dynstr': R,
        b'.gnu.version': R,
        b'.gnu.version_r': R,
        b'.rela.dyn': R,
        b'.rela.plt': R,
        b'.rodata': R,
        b'.eh_frame_hdr': R,
        b'.eh_frame': R,
        b'.qtmetadata': R,
        b'.gcc_except_table': R,
        b'.stapsdt.base': R,
        # Writable data
        b'.init_array': R | W,
        b'.fini_array': R | W,
        b'.dynamic': R | W,
        b'.got': R | W,
        b'.data': R | W,
        b'.bss': R | W,
    }
    if elf.hdr.e_machine == pixie.EM_PPC64:
        # .plt is RW on ppc64 even with separate-code
        EXPECTED_FLAGS[b'.plt'] = R | W
    # For all LOAD program headers get mapping to the list of sections,
    # and for each section, remember the flags of the associated program header.
    flags_per_section = {}
    for ph in elf.program_headers:
        if ph.p_type == pixie.PT_LOAD:
            for section in ph.sections:
                assert(section.name not in flags_per_section)
                flags_per_section[section.name] = ph.p_flags
    # Spot-check ELF LOAD program header flags per section
    # If these sections exist, check them against the expected R/W/E flags
    for (section, flags) in flags_per_section.items():
        if section in EXPECTED_FLAGS:
            if EXPECTED_FLAGS[section] != flags:
                return False
    return True

    Check that sections are appropriately separated in virtual memory,
    based on their permissions. This checks for missing -Wl,-z,separate-code
    and potentially other problems.
    
Check that sections are appropriately separated in virtual memory,
based on their permissions. This checks for missing -Wl,-z,separate-code
and potentially other problems.
Check that sections are appropriately separated in virtual memory based on their permissions . This checks for missing - Wl - z separate - code and potentially other problems .
def check_ELF_separate_code(executable):
    elf = pixie.load(executable)
    R = pixie.PF_R
    W = pixie.PF_W
    E = pixie.PF_X
    EXPECTED_FLAGS = {
        b'.init': R | E,
        b'.plt': R | E,
        b'.plt.got': R | E,
        b'.plt.sec': R | E,
        b'.text': R | E,
        b'.fini': R | E,
        b'.interp': R,
        b'.note.gnu.property': R,
        b'.note.gnu.build-id': R,
        b'.note.ABI-tag': R,
        b'.gnu.hash': R,
        b'.dynsym': R,
        b'.dynstr': R,
        b'.gnu.version': R,
        b'.gnu.version_r': R,
        b'.rela.dyn': R,
        b'.rela.plt': R,
        b'.rodata': R,
        b'.eh_frame_hdr': R,
        b'.eh_frame': R,
        b'.qtmetadata': R,
        b'.gcc_except_table': R,
        b'.stapsdt.base': R,
        b'.init_array': R | W,
        b'.fini_array': R | W,
        b'.dynamic': R | W,
        b'.got': R | W,
        b'.data': R | W,
        b'.bss': R | W,
    }
    if elf.hdr.e_machine == pixie.EM_PPC64:
        EXPECTED_FLAGS[b'.plt'] = R | W
    flags_per_section = {}
    for ph in elf.program_headers:
        if ph.p_type == pixie.PT_LOAD:
            for section in ph.sections:
                assert(section.name not in flags_per_section)
                flags_per_section[section.name] = ph.p_flags
    for (section, flags) in flags_per_section.items():
        if section in EXPECTED_FLAGS:
            if EXPECTED_FLAGS[section] != flags:
                return False
    return True
def check_ELF_separate_code ( executable ) : elf = pixie . load ( executable ) R = pixie . PF_R W = pixie . PF_W E = pixie . PF_X EXPECTED_FLAGS = { b'.init' : R | E , b'.plt' : R | E , b'.plt.got' : R | E , b'.plt.sec' : R | E , b'.text' : R | E , b'.fini' : R | E , b'.interp' : R , b'.note.gnu.property' : R , b'.note.gnu.build-id' : R , b'.note.ABI-tag' : R , b'.gnu.hash' : R , b'.dynsym' : R , b'.dynstr' : R , b'.gnu.version' : R , b'.gnu.version_r' : R , b'.rela.dyn' : R , b'.rela.plt' : R , b'.rodata' : R , b'.eh_frame_hdr' : R , b'.eh_frame' : R , b'.qtmetadata' : R , b'.gcc_except_table' : R , b'.stapsdt.base' : R , b'.init_array' : R | W , b'.fini_array' : R | W , b'.dynamic' : R | W , b'.got' : R | W , b'.data' : R | W , b'.bss' : R | W , } if elf . hdr . e_machine == pixie . EM_PPC64 : EXPECTED_FLAGS [ b'.plt' ] = R | W flags_per_section = { } for ph in elf . program_headers : if ph . p_type == pixie . PT_LOAD : for section in ph . sections : assert ( section . name not in flags_per_section ) flags_per_section [ section . name ] = ph . p_flags for ( section , flags ) in flags_per_section . items ( ) : if section in EXPECTED_FLAGS : if EXPECTED_FLAGS [ section ] != flags : return False return True
Check that sections are appropriately separated in virtual memory,
based on their permissions.
Check that sections are appropriately separated in virtual memory based on their permissions .
'''
    Check that sections are appropriately separated in virtual memory,
    based on their permissions. This checks for missing -Wl,-z,separate-code
    and potentially other problems.
    ''' # Read + execute # Read-only data # Writable data # .plt is RW on ppc64 even with separate-code # For all LOAD program headers get mapping to the list of sections, # and for each section, remember the flags of the associated program header. # Spot-check ELF LOAD program header flags per section # If these sections exist, check them against the expected R/W/E flags
executable