PROT_EXEC to mmap(2) during mediation which may cause security denials

[marcoancona]

Goals

We are trying to ship an Electron app that uses Realm in the Snapcraft store for Linux

Expected Results

No execstack is required by Realm binaries

Actual Results

An issue is raised:

Found files with executable stack. This adds PROT_EXEC to mmap(2) during mediation which may cause security denials. Either adjust your program to not require an executable stack, strip it with 'execstack --clear-execstack ...' or remove the affected file from your snap. Affected files: resources/app.asar.unpacked/node_modules/realm/build/Release/realm.node (Refer to https://forum.snapcraft.io/t/snap-and-executable-stacks/1812)

This issue is to suggest to remove execstack from the node binaries if not needed.

Version of Realm and Tooling

• Realm JS SDK Version: 10.4.1
• Node or React Native: Node (Electron)
• Client OS & Version: Linux

[kraenhansen]

@marcoancona thanks for reporting this.
There should be no reason this should be set from our libraries point of view.
Do you know how / where to configure this?

[kneth]

@RedBeard0531 mentioned that https://github.com/mongodb/mongo/blob/master/SConstruct#L3737-L3742 might be a solution.

[marcoancona]

@kraenhansen
I am not an expert here, but according to https://forum.snapcraft.io/t/snap-and-executable-stacks/1812 you can also strip the flag after building:

execstack --clear-execstack ./realm.node

Of course a solution during the building phase might be preferable.