使用Crosstools交叉编译的PowerPC .so文件含RWE头，需改为RW的技术问询

Alright, let's tackle this RWE vs RW permission issue for your 32-bit PowerPC shared objects. I’ve dealt with similar cross-compiler quirks when targeting legacy architectures, so here’s a breakdown of what’s happening and actionable fixes to satisfy your client’s security requirements.

When readelf -a shows a segment marked RWE (Read-Write-Execute), that means a loadable segment in your .so has unnecessary execute permissions—this is a security red flag, as data segments should only require Read+Write (RW) while code segments need Read+Execute (RE). Here's how to fix this:

1. Update or Tune Your Crosstools Cross-Compiler #

Older Crosstools builds often default to overly permissive segment flags for PowerPC 32-bit, especially when targeting older ABIs.

• Rebuild with a modern Crosstools-NG: Use the maintained Crosstools-NG fork to build a new cross-compiler with up-to-date security defaults. This often resolves permission issues out of the box without manual tweaks.
• Enforce secure compiler/linker flags: Ensure you're compiling all source files with -fPIC (required for shared libraries) and linking with -shared. Add -Wl,-z,relro,-z,now to enable read-only relocations and immediate binding—this tightens segment permissions as a side effect.

2. Customize the Linker Script #

Cross-compilers rely on default linker scripts to define segment permissions. You can modify this script to force RW-only for data segments:

1. Extract the default linker script from your cross-compiler:

   powerpc-linux-gnu-ld --verbose > default-script.ld
   

   (Replace powerpc-linux-gnu-ld with your actual cross-linker command.)
2. Open default-script.ld in a text editor. Look for loadable segment definitions, specifically lines with FLAGS or p_flags. For data segments, change any occurrence of EXEC (or hex 0x7 for RWE) to NOEXEC (or hex 0x6 for RW).
   Example change:

   # Before
   .data : { *(.data) } :data FLAGS(0x7)
   # After
   .data : { *(.data) } :data FLAGS(0x6)
   

3. Link your shared library with the custom script using the -T flag:

   powerpc-linux-gnu-gcc -shared -o your-lib.so obj-files.o -T default-script.ld
   

3. Post-Process Existing .so Files #

If you need to fix already-built libraries without re-compiling, use ELF editing tools:

• Using elfedit (program header fix):
  1. Identify the problematic PT_LOAD segment with readelf -l your-lib.so—look for the segment where Flags show RWE.
  2. Suppose the segment is at index 1 (check the Idx column). Update its flags to RW (hex 0x6, combining PF_R and PF_W):

     elfedit --input-pindex=1 --output-pflags=0x6 your-lib.so
     

• Using objcopy (section flag fix):
  Adjust permissions for specific data sections like .data directly:

  objcopy --set-section-flags .data=alloc,load,write your-lib.so
  

Verify the Fix #

After applying any solution, re-run readelf -l your-lib.so and confirm the relevant segments now show only RW (no E flag) in the Flags column.

内容的提问来源于stack exchange，提问作者Douglas Coup