Where are page permissions stored in an ELF binary?

Question

Perhaps I am misunderstanding how this works, but to my knowledge ELF binaries can either have NX protections for the stack, or not. What I am assuming is that there is a place in the binary that spells this out, but I'm not sure exactly where this information is stored.

How do you figure out the page permissions for an ELF binary from a disassembly?

Turns out it's in the headers, but I might leave the question up for other people who had trouble googling it like me. Serves me right for not knowing the ELF header format. — MrSynAckSter, Mar 25 '15 at 18:34
I will when I am eligible, unless someone answers it in a fancy way :) — MrSynAckSter, Mar 25 '15 at 22:02

broadway · Accepted Answer · 2015-03-26T06:41:11.203

Permissions are in the p_flags member of the program header.

       typedef struct {
           uint32_t   p_type;
           Elf32_Off  p_offset;
           Elf32_Addr p_vaddr;
           Elf32_Addr p_paddr;
           uint32_t   p_filesz;
           uint32_t   p_memsz;
           uint32_t   p_flags;
           uint32_t   p_align;
       } Elf32_Phdr;

       p_flags     This member holds a bit mask of flags relevant to the
                   segment:

                   PF_X   An executable segment.
                   PF_W   A writable segment.
                   PF_R   A readable segment.

                   A text segment commonly has the flags PF_X and PF_R.  A
                   data segment commonly has PF_X, PF_W and PF_R.

score 2 · Answer 2 · 2015-03-28T14:11:39.937

The ELF binaries have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.

Where are page permissions stored in an ELF binary?

2 Answers2