.note.GNU-stack
By chys on December 25th, 2010
GCC always appends one line to any assembler file (.s) file it generates:
.section .note.GNU-stack,"",@progbits
Literally, it adds an empty section named .note.GNU-stack to the object file, but it actually serves a hint to the linker* that code in this object file does not require an executable stack. GNU assembler also accepts command-line option “--noexecstack”, which has the same effect.
If every object file contains a section of this name, the linker knows the whole program does not need an executable stack, and the resulting executable will run with a non-executable stack if the OS and underlying hardware support it (see also NX bit).
Why is this important? In practice, virtually no program needs an executable stack (hackers may sometimes use it, though), but buffer overflow attacks frequently insert and run code in stacks. A non-executable stack helps improve security without any overhead.
* GNU linker only.
Related posts:
Note that GCC doesn’t always do this. GCC has an implementation of closures for GNU C that requires an executable stack:
http://gcc.gnu.org/onlinedocs/gcc/Nested-Functions.html
For example this program runs qsort and uses a closure to count the number of comparisons in a local variable:
https://gist.github.com/837493
The assembly it generates has this line that makes the stack executable:
.section .note.GNU-stack,”x”,@progbits
So, I guess using closures in GNU C makes your program more vulnerable.