I want to create a binary on MacOS Catalina (64 bit) with a data segment that can be made executable (see here for details) but is not executable from the start.
I make my binary with
gcc -nostdlib -segprot __DATA rwx rw- ....
I also created an object file with gcc and then called ld directly. The ld version is
$ ld -v
@(#)PROGRAM:ld PROJECT:ld64-530
BUILD 18:57:17 Dec 13 2019
configured to support archs: armv6 armv7 armv7s arm64 arm64e arm64_32 i386 x86_64 x86_64h armv6m armv7k armv7m armv7em
LTO support using: LLVM version 11.0.0, (clang-1100.0.33.17) (static support for 23, runtime is 23)
TAPI support using: Apple TAPI version 11.0.0 (tapi-1100.0.11)
That should make the data segment initially RW, but allow me to use mprotect to extend permission in that segment to RWX.
However, I notice that the __DATA segment is RW for initial and max permission:
$ otool -l jonesforth
.
.
.
Load command 2
cmd LC_SEGMENT_64
cmdsize 312
segname __DATA
vmaddr 0x0000000100001000
vmsize 0x0000000000024000
fileoff 4096
filesize 4096
maxprot 0x00000003
initprot 0x00000003
nsects 3
flags 0x0
Section
.
.
.
Is there something I'm missing? The darwin documentation here says:
-segprot name max init (32-bit only)
Specifies the maximum and initial virtual memory protection of
the named segment, name, to be max and init ,respectively. The
values for max and init are any combination of the characters
`r' (for read), `w' (for write), `x' (for execute) and '-' (no
access). The default is `rwx' for the maximum protection for
all segments for PowerPC architecures and `rw` for the all Intel
architecures. The default for the initial protection for all
segments is `rw' unless the segment contains a section which
contains some machine instructions, in which case the default
for the initial protection is `rwx' (and for Intel architecures
it also sets the maximum protection to `rwx' in this case). The
default for the initial protection for the ``__TEXT'' segment is
`rx' (not writable).
Of course, that the darwin (32 bit only) documentation but it's the only thing I found. I suspect that either gcc does not 'properly' support the darwin protection syntax, or it's broken, or things in darwin changed from x86 to x64.
Any pointers would be great, thanks in advance.
Yes, something did happen on March 18:
Apple committed a change that makes ld always set maxprot = initprot for non-i386 architectures, so including x64, ie Catalina. It's unclear whether this was intentional, it's at odds with the ld manpage.
One workaround is of course to set the desired protection level for the entire segment in initprot. One can probably move the desired data/code into a separate segment if one wants to have finer grained control.
Another workaround, thanks to the comment from Darfink: One can also change the linker or modify the desired maxprot after ld runs. Darfink pointed out his ld64 wrapper, a python script, to automate this.
User contributions licensed under CC BY-SA 3.0