blymn@baea.com.au (Brett Lymn) writes:
> For the i386 architecture there was some linux hacks that would stop
> the stack being executable - dunno how portable they would be, if at
> all.  You need to be careful about doing this though as the changes
> are more than just a kernel hack.  IIRC gcc relies on an executable
> stack for some of it's trampoline code which means that some things
> could break with a non-executable stack.  The up side is that it does
> provide a convenient method of preventing the fixed-buffer overrun type
> exploits that are currently fashionable in the cracker community.

I don't think it's worth it.  It only gives you a false sense of
security.  There were exploits posed some time ago on bugtraq that
didn't depend on the stack being executable.  And, as you mention, gcc
depends on the stack being executable (which is, IIRC, the reason that
those fixes were not incorporated into linux).

BTW, there are also some hacks for doing the same thing on Solaris.

/assar