audio/flac with nasm results in executable stack on NetBSD

[Christian Biere <christianbiere%gmx.de@localhost>]

Hi,

on NetBSD/i386 if audio/flac is built using nasm the resulting libFLAC.so
always contains a stack segment marked as "rwx". mkvmerge (of
multimedia/mkvtoolnix) linked against libFLAC.so does not even start with
security.pax.mprotect.global=1 but fails with

/usr/pkg/lib/libFLAC.so: "Cannot write-enable text segment"

The nasm source files found in audio/flac contain this:

%ifdef OBJ_FORMAT_elf
        section .note.GNU-stack noalloc
%endif

I also tried adding "noexec nowrite progbits" to this line but it doesn't seem
to have any effect at all. The only thing that worked was deinstalling nasm,
removing the dependency from audio/flac/Makefile and then building without
nasm. I doubt there's any noteworthy performance difference, maybe it's not
even measurable, so I'm fine with this.

However, I'm surprised that I could hardly find any information about this. Has
nobody using NetBSD enabled PaX? I've had this problem with a few other tools
and libraries, for example, libtheora and others which I don't remember
off-hand (probably anything using nasm). So far I resorted to disable PaX
temporarily considering that my system was somewhat outdated anyway and I
assumed these issues would disappear after an update.

Do linker hints (".note.GNU-stack") like this work on NetBSD at all?
If not, what's the alternative way?

-- 
Christian