Fedora 40 Looking To Change Linker To Error Out On Security Issues

A change proposal currently undergoing discussion for Fedora 40 would change their toolchain's (BFD) linker to error out on potential security issues. Currently BFD is emitting warnings on potential security problems but the F40 proposal is to instead error out so the program being built will fail to link when hitting recognized security issues.

The Fedora 40 change proposal would be affecting the behavior of:

- The creation of a program containing a stack that is in a memory region that has execute permission.
- The creation of a program with a loadable segment that has all three of the read, write and execute permission bits set.
- The creation of a thread local storage segment that has the execute permission bit set.

With not as many developers/users paying attention to warnings as when a show-stopping error occurs, the intention for Fedora 40 is to raise those to errors with the BFD linker.

Per the Fedora 40 change proposal:

The benefit of this change is that it will increase the overall security of Fedora by helping to ensure that packages cannot be built with one or more of these vulnerabilities without the owner being made aware and having to take specific actions - either to remove the vulnerability or disable the linker error message.

More details for those interested via the Fedora Wiki. The Fedora Engineering and Steering Committee (FESCo) still needs to vote on the change before it potentially becoming a feature of Fedora 40 in the spring.