Disable PAX mprotect for native executables

This change adds marking native executables that core-setup build produces
(dotnet, apphost) using the paxctl tool to allow them running on systems
with PAX configured so that creating executable memory mappings by applications
is prohibited.

Commit migrated from https://github.com/dotnet/core-setup/commit/20c56a0ab9c3b7967a02733b1b72103f41aa8756

diff --git a/src/installer/corehost/cli/exe/exe.cmake b/src/installer/corehost/cli/exe/exe.cmake
index 3ba5490..37289d1 100644 (file)
--- a/src/installer/corehost/cli/exe/exe.cmake
+++ b/src/installer/corehost/cli/exe/exe.cmake
@@ -43,6 +43,11 @@ if(WIN32 AND NOT SKIP_VERSIONING)
 endif()
 
 add_executable(${DOTNET_HOST_EXE_NAME} ${SOURCES} ${RESOURCES})
+
+if(NOT WIN32)
+    disable_pax_mprotect(${DOTNET_HOST_EXE_NAME})
+endif()
+
 install(TARGETS ${DOTNET_HOST_EXE_NAME} DESTINATION bin)
 
 # Specify the import library to link against for Arm32 build since the default set is minimal

diff --git a/src/installer/settings.cmake b/src/installer/settings.cmake
index 50c52fd..47e0ec0 100644 (file)
--- a/src/installer/settings.cmake
+++ b/src/installer/settings.cmake
@@ -35,6 +35,11 @@ if(CMAKE_SYSTEM_NAME STREQUAL SunOS)
 endif(CMAKE_SYSTEM_NAME STREQUAL SunOS)
 
 if (NOT WIN32)
+    # Try to locate the paxctl tool. Failure to find it is not fatal,
+    # but the generated executables won't work on a system where PAX is set
+    # to prevent applications to create executable memory mappings.
+    find_program(PAXCTL paxctl)
+
     if (CMAKE_SYSTEM_NAME STREQUAL Darwin)
         # Ensure that dsymutil and strip are present
         find_program(DSYMUTIL dsymutil)
@@ -126,6 +131,24 @@ function(install_library_and_symbols targetName)
     endif()
 endfunction()
 
+# Disable PAX mprotect that would prevent JIT and other codegen in coreclr from working.
+# PAX mprotect prevents:
+# - changing the executable status of memory pages that were
+#   not originally created as executable,
+# - making read-only executable pages writable again,
+# - creating executable pages from anonymous memory,
+# - making read-only-after-relocations (RELRO) data pages writable again.
+function(disable_pax_mprotect targetName)
+    if (NOT PAXCTL STREQUAL "PAXCTL-NOTFOUND")
+        add_custom_command(
+            TARGET ${targetName}
+            POST_BUILD
+            VERBATIM
+            COMMAND ${PAXCTL} -c -m $<TARGET_FILE:${targetName}>
+        )
+    endif()
+endfunction()
+
 if(WIN32)
     add_definitions(-DWIN32)
     add_definitions(-D_WIN32=1)