[go] cmd/link: use relro for internally linked openbsd executables

6 views
Skip to first unread message

Josh Harshman (Gerrit)

unread,
Oct 12, 2026, 7:57:45 PM (10 days ago) Oct 12
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com

Josh Harshman has uploaded the change for review

Commit message

cmd/link: use relro for internally linked openbsd executables

OpenBSD binaries are always dynamically linked when linking internally.
Go makes system calls through libc there so ld.so is always present to
apply relro. Enable it by adding a new condition in the UseRelro()
method.

In support of CL 641615 which adds .openbsd.randomdata to relro segment.

For #69781
Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c

Change diff

diff --git a/src/cmd/link/elf_test.go b/src/cmd/link/elf_test.go
index 9b06d71..37da349 100644
--- a/src/cmd/link/elf_test.go
+++ b/src/cmd/link/elf_test.go
@@ -625,6 +625,15 @@
 	}
 	defer ef.Close()
 
+	inRelro := func(sec *elf.Section) bool {
+		for _, p := range ef.Progs {
+			if p.Type == elf.PT_GNU_RELRO && p.Vaddr <= sec.Addr && sec.Addr < p.Vaddr+p.Memsz {
+				return true
+			}
+		}
+		return false
+	}
+
 	// Find the first data-related section to verify segment placement
 	var firstDataSection *elf.Section
 	for _, sec := range ef.Sections {
@@ -636,7 +645,7 @@
 			isAlloc := sec.Flags&elf.SHF_ALLOC != 0
 			isTLS := sec.Flags&elf.SHF_TLS != 0
 
-			if isWrite && !isExec && isAlloc && !isTLS {
+			if isWrite && !isExec && isAlloc && !isTLS && !inRelro(sec) {
 				if firstDataSection == nil || sec.Addr < firstDataSection.Addr {
 					firstDataSection = sec
 				}
diff --git a/src/cmd/link/internal/ld/target.go b/src/cmd/link/internal/ld/target.go
index d0ce99f..5e46f84 100644
--- a/src/cmd/link/internal/ld/target.go
+++ b/src/cmd/link/internal/ld/target.go
@@ -80,6 +80,13 @@
 			// On darwin/ARM64, everything is PIE.
 			return true
 		}
+		if t.HeadType == objabi.Hopenbsd && t.LinkMode == LinkInternal {
+			// On OpenBSD, internally linked binaries are always dynamically linked
+			// and ld.so is always present to apply relro.
+			// Externally linked binaries may be static with nothing to apply relro.
+			// Layout is therefore left alone.
+			return true
+		}
 		return t.linkShared || (t.HeadType == objabi.Haix && t.LinkMode == LinkExternal)
 	}
 }

Change information

Files:
  • M src/cmd/link/elf_test.go
  • M src/cmd/link/internal/ld/target.go
Change size: S
Delta: 2 files changed, 17 insertions(+), 1 deletion(-)
Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c
Gerrit-Change-Number: 848926
Gerrit-PatchSet: 1
Gerrit-Owner: Josh Harshman <jo...@harshman.me>
unsatisfied_requirement
satisfied_requirement
open
diffy

Ian Lance Taylor (Gerrit)

unread,
Oct 12, 2026, 9:37:29 PM (10 days ago) Oct 12
to Josh Harshman, goph...@pubsubhelper.golang.org, Ian Lance Taylor, golang-co...@googlegroups.com
Attention needed from Josh Harshman

Ian Lance Taylor voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Josh Harshman
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c
Gerrit-Change-Number: 848926
Gerrit-PatchSet: 1
Gerrit-Owner: Josh Harshman <jo...@harshman.me>
Gerrit-Reviewer: Ian Lance Taylor <ia...@golang.org>
Gerrit-Attention: Josh Harshman <jo...@harshman.me>
Gerrit-Comment-Date: Tue, 13 Oct 2026 01:37:19 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
unsatisfied_requirement
satisfied_requirement
open
diffy

Ian Lance Taylor (Gerrit)

unread,
Oct 14, 2026, 8:24:22 PM (8 days ago) Oct 14
to Josh Harshman, goph...@pubsubhelper.golang.org, Ian Lance Taylor, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com
Attention needed from Josh Harshman

Ian Lance Taylor voted and added 1 comment

Votes added by Ian Lance Taylor <ia...@golang.org>

Auto-Submit+1
Code-Review+2

1 comment

Patchset-level comments
File-level comment, Patchset 1 (Latest):
Ian Lance Taylor . resolved

Thanks.

Open in Gerrit

Related details

Attention is currently required from:
  • Josh Harshman
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c
Gerrit-Change-Number: 848926
Gerrit-PatchSet: 1
Gerrit-Owner: Josh Harshman <jo...@harshman.me>
Gerrit-Reviewer: Ian Lance Taylor <ia...@golang.org>
Gerrit-Attention: Josh Harshman <jo...@harshman.me>
Gerrit-Comment-Date: Thu, 15 Oct 2026 00:24:08 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Joel Sing (Gerrit)

unread,
Oct 15, 2026, 10:38:38 AM (7 days ago) Oct 15
to Josh Harshman, goph...@pubsubhelper.golang.org, Ian Lance Taylor, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com
Attention needed from Josh Harshman

Joel Sing added 1 comment

File src/cmd/link/internal/ld/target.go
Line 83, Patchset 1 (Latest): if t.HeadType == objabi.Hopenbsd && t.LinkMode == LinkInternal {
Joel Sing . unresolved

AIUI we should be able to enable this unconditionally for OpenBSD - external linking should handle relro in all cases.

Open in Gerrit

Related details

Attention is currently required from:
  • Josh Harshman
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c
Gerrit-Change-Number: 848926
Gerrit-PatchSet: 1
Gerrit-Owner: Josh Harshman <jo...@harshman.me>
Gerrit-Reviewer: Ian Lance Taylor <ia...@golang.org>
Gerrit-CC: Joel Sing <jo...@sing.id.au>
Gerrit-Attention: Josh Harshman <jo...@harshman.me>
Gerrit-Comment-Date: Thu, 15 Oct 2026 14:38:12 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Josh Harshman (Gerrit)

unread,
Oct 15, 2026, 6:33:06 PM (7 days ago) Oct 15
to goph...@pubsubhelper.golang.org, Joel Sing, Ian Lance Taylor, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com
Attention needed from Joel Sing

Josh Harshman added 1 comment

File src/cmd/link/internal/ld/target.go
Line 83, Patchset 1 (Latest): if t.HeadType == objabi.Hopenbsd && t.LinkMode == LinkInternal {
Joel Sing . unresolved

AIUI we should be able to enable this unconditionally for OpenBSD - external linking should handle relro in all cases.

Josh Harshman

I've tested this on OpenBSD 7.9 (amd64). When linkmode is set to external (with -linkmode=external -extldflags=-static), the result is a static bin and ld.so is not used to apply relro. End result is the segment is left writable.

Open in Gerrit

Related details

Attention is currently required from:
  • Joel Sing
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I23238742ec1d6a7db2ac20148e448aed82bb9a6c
Gerrit-Change-Number: 848926
Gerrit-PatchSet: 1
Gerrit-Owner: Josh Harshman <jo...@harshman.me>
Gerrit-Reviewer: Ian Lance Taylor <ia...@golang.org>
Gerrit-CC: Joel Sing <jo...@sing.id.au>
Gerrit-Attention: Joel Sing <jo...@sing.id.au>
Gerrit-Comment-Date: Thu, 15 Oct 2026 22:32:54 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Joel Sing <jo...@sing.id.au>
satisfied_requirement
unsatisfied_requirement
open
diffy
Reply all
Reply to author
Forward
0 new messages