bin/51655: Confusion on where paxctl(8) stores its flags

[paul%whooppee.com@localhost]

>Number:         51655
>Category:       bin
>Synopsis:       Confusion on where paxctl(8) stores its flags
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          doc-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 26 07:15:00 +0000 2016
>Originator:     Paul Goyette
>Release:        NetBSD 7.99.42
>Organization:
+------------------+--------------------------+------------------------+
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:      |
| (Retired)        | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com   |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd.org |
+------------------+--------------------------+------------------------+
>Environment:
	
	
System: NetBSD speedy.whooppee.com 7.99.42 NetBSD 7.99.42 (SPEEDY 2016-11-12 03:07:23) #0: Sun Nov 13 13:50:32 PHT 2016 paul%speedy.whooppee.com@localhost:/build/netbsd-local/obj/amd64/sys/arch/amd64/compile/SPEEDY amd64
Architecture: x86_64
Machine: amd64
>Description:
The man page for paxctl(8) indicates (in the BUGS section) that

     The paxctl utility currently uses elf(5) ``note'' sections to mark
     executables as having PaX flags enabled.  This will be done using
     fileassoc(9) in the future ...

However, with a current source tree, building a kernel which includes the
various PaX options requires fileassoc(9) to also be included in the
kernel.  Building a kernel with PaX but without fileassoc results in link
errors.

Furthermore, I can find nothing in the man pages that indicates that

	options FILEASSOC

is required to build kernels with the PAX_* options enabled.
	
>How-To-Repeat:

Craete a kernel config as follows, and try to build it:

	include "arch/amd/conf/GENERIC"
	no options 	FILEASSOC


	
>Fix:
     1. (Preferred) Update the documentation (perhaps in options(4)?) to
        indicate that PAX_* requires FILEASSOC

     2. If paxctl(8) actually _does_ use fileassoc(9) for storing the
        flags (ie, no longer uses the ELF notes), then paxctl(8) man
        page also needs updating.

     3. Otherwise, we should remove the dependency on FILEASSOC until
        such time as it is really needed.
	

>Unformatted: