Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 24 Jun 2020 12:39:24 -0700
From:   Kees Cook <keescook@chromium.org>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Christian Kujau <lists@nerdbynature.de>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Willy Tarreau <w@1wt.eu>, linux-kernel@vger.kernel.org
Subject: Re: process '/usr/bin/rsync' started with executable stack
Message-ID: <202006241238.E9CB1CE85B@keescook>
References: <alpine.DEB.2.22.1.446.2006231023390.3892@trent.utfs.org>
 <20200624165148.GD31008@kadam>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20200624165148.GD31008@kadam>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Jun 24, 2020 at 07:51:48PM +0300, Dan Carpenter wrote:
> In Debian testing the initrd triggers the warning.
> 
> [   34.529809] process '/usr/bin/fstype' started with executable stack

Where does fstype come from there? I am going to guess it is either
busybox or linked against klibc?

klibc has known problems with executable stacks due to its trampoline
implementation:
https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks

> 
> $ checksec --format=json --extended --file=/var/tmp/mkinitramfs_eTyMPQ/bin/fstype | jq
> {
>   "file": {
>     "relro": "no",
>     "canary": "no",
>     "nx": "no",
>     "pie": "no",
>     "clangcfi": "no",
>     "safestack": "no",
>     "rpath": "no",
>     "runpath": "no",
>     "symbols": "no",
>     "fortify_source": "no",
>     "fortified": "0",
>     "fortify-able": "0"
>   }
> }

Wow. _nothing_ implemented. :(

-- 
Kees Cook