lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 14 Dec 2020 15:33:53 -0800
From:   Nick Desaulniers <>
To:     Alan Modra <>
Cc:     Catalin Marinas <>,
        kernel-team <>,
        Will Deacon <>,
        LKML <>,
        Peter Smith <>,
        clang-built-linux <>,
        "# 3.4.x" <>,
        Linux ARM <>,
        Ard Biesheuvel <>,
        Fāng-ruì Sòng <>,
        Quentin Perret <>
Subject: Re: [PATCH] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE

On Mon, Dec 14, 2020 at 3:18 PM Alan Modra <> wrote:
> On Mon, Dec 14, 2020 at 01:44:06PM -0800, Nick Desaulniers wrote:
> > aarch64-linux-gnu-ld: warning: -z norelro ignored
> >
> > So we set the emulation mode via -maarch64elf, and our preprocessed
> The default linker emulation for an aarch64-linux ld.bfd is
> -maarch64linux, the default for an aarch64-elf linker is
> -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
> you get an emulation that doesn't support -z relro.
> Now I don't know why the kernel uses -maarch64elf so you shouldn't
> interpret my comment as a recommendation to use -maarch64linux
> instead.  That may have other unwanted effects.

Cool, thanks for the context.  The kernel currently has:

# Prefer the baremetal ELF build target, but not all toolchains include
# it so fall back to the standard linux version if needed.
LDFLAGS                += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb)
# Same as above, prefer ELF but fall back to linux target if needed.
LDFLAGS                += -EL $(call ld-option, -maarch64elf, -maarch64linux)

$ git log -S maarch64elf arch/arm64/Makefile
provides more context:

So it seems more that the kernel is relying on whichever emulation
targets are supported in local distros, not necessarily the semantic
differences between the two.  Since the kernel might be linked as
either, I'll send the patch described in my last post to add `-z
norelro` just when linking with LLD, since it sounds like it's only
possible to specify when -maarch64linux/-maarch64linuxb is used, which
is unlikely.
~Nick Desaulniers

Powered by blists - more mailing lists