parameters: (executable)
return_statement: return have_gnu_relro and have_bindnow
docstring: Check for read-only relocations.
      GNU_RELRO program header must exist
      Dynamic section must have BIND_NOW flag
docstring_summary: Check for read-only relocations.
      GNU_RELRO program header must exist
      Dynamic section must have BIND_NOW flag
docstring_tokens: Check for read - only relocations . GNU_RELRO program header must exist Dynamic section must have BIND_NOW flag
function: def check_ELF_RELRO(executable):
      '''
      Check for read-only relocations.
      GNU_RELRO program header must exist
      Dynamic section must have BIND_NOW flag
      '''
      have_gnu_relro = False
      for (typ, flags) in get_ELF_program_headers(executable):
          # Note: not checking flags == 'R': here as linkers set the permission differently
          # This does not affect security: the permission flags of the GNU_RELRO program header are ignored, the PT_LOAD header determines the effective permissions.
          # However, the dynamic linker need to write to this area so these are RW.
          # Glibc itself takes care of mprotecting this area R after relocations are finished.
          # See also http://permalink.gmane.org/gmane.comp.gnu.binutils/71347
          if typ == 'GNU_RELRO':
              have_gnu_relro = True
  
      have_bindnow = False
      p = subprocess.Popen([READELF_CMD, '-d', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
      (stdout, stderr) = p.communicate()
      if p.returncode:
          raise IOError('Error opening file')
      for line in stdout.splitlines():
          tokens = line.split()
          if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2:]):
              have_bindnow = True
      return have_gnu_relro and have_bindnow
function_tokens: def check_ELF_RELRO ( executable ) : have_gnu_relro = False for ( typ , flags ) in get_ELF_program_headers ( executable ) : # Note: not checking flags == 'R': here as linkers set the permission differently # This does not affect security: the permission flags of the GNU_RELRO program header are ignored, the PT_LOAD header determines the effective permissions. # However, the dynamic linker need to write to this area so these are RW. # Glibc itself takes care of mprotecting this area R after relocations are finished. # See also http://permalink.gmane.org/gmane.comp.gnu.binutils/71347 if typ == 'GNU_RELRO' : have_gnu_relro = True have_bindnow = False p = subprocess . Popen ( [ READELF_CMD , '-d' , '-W' , executable ] , stdout = subprocess . PIPE , stderr = subprocess . PIPE , stdin = subprocess . PIPE , universal_newlines = True ) ( stdout , stderr ) = p . communicate ( ) if p . returncode : raise IOError ( 'Error opening file' ) for line in stdout . splitlines ( ) : tokens = line . split ( ) if len ( tokens ) > 1 and tokens [ 1 ] == '(BIND_NOW)' or ( len ( tokens ) > 2 and tokens [ 1 ] == '(FLAGS)' and 'BIND_NOW' in tokens [ 2 : ] ) : have_bindnow = True return have_gnu_relro and have_bindnow