[s390x] Missing full RELRO (-z,now) support in a mono-based libcoreclr.so

[omajid]

Description

.NET has full relro (See #632) enabled for all unmanaged libraries, including libcoreclr.so. For more background on full RELRO, see https://www.redhat.com/en/blog/hardening-elf-binaries-using-relocation-read-only-relro.

Unfortunately, full RELRO is not enabled for a mono-based libcoreclr.so, such as the one that gets used on s390x. -z,relro is present but not -z,now.

I am running a self-built .NET SDK based on source-build on s390x for this:

$ readelf -l /usr/lib64/dotnet/shared/Microsoft.NETCore.App/6.0.0-rc.2.21470.23/libcoreclr.so | grep GNU_RELRO
  GNU_RELRO      0x00000000004ae4e8 0x00000000004af4e8 0x00000000004af4e8                                            
$ readelf -d /usr/lib64/dotnet/shared/Microsoft.NETCore.App/6.0.0-rc.2.21470.23/libcoreclr.so | grep BIND_NOW

Configuration

This is a self-built .NET SDK on s390x running on RHEL 8:

$ /usr/lib64/dotnet/dotnet --info
.NET SDK (reflecting any global.json):
 Version:   6.0.100-rc.2.21474.1
 Commit:    28be3e9a00

Runtime Environment:
 OS Name:     rhel
 OS Version:  8
 OS Platform: Linux
 RID:         rhel.8-s390x
 Base Path:   /usr/lib64/dotnet/sdk/6.0.100-rc.2.21474.1/

Host (useful for support):
  Version: 6.0.0-rc.2.21470.23
  Commit:  826f81a11a

.NET SDKs installed:
  6.0.100-rc.2.21474.1 [/usr/lib64/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.0-rc.2.21470.37 [/usr/lib64/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.0-rc.2.21470.23 [/usr/lib64/dotnet/shared/Microsoft.NETCore.App]

To install additional .NET runtimes or SDKs:
  https://aka.ms/dotnet-download

This was built from dotnet/installer commit 28be3e9a006d90d8c6e87d4353b77882829df718.

Regression?

This is a regression compared to Intel (x64)

cc @uweigand @BahaVv

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[uweigand]

For coreclr, this comes from eng/native/configurecompiler.cmake which defines:

if(CLR_CMAKE_HOST_LINUX)
  add_compile_options($<$<COMPILE_LANGUAGE:ASM>:-Wa,--noexecstack>)
  add_linker_flag(-Wl,--build-id=sha1)
  add_linker_flag(-Wl,-z,relro,-z,now)

The Mono build doesn't appear to use configurecompiler.cmake but has its own set of definitions. These include:

elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux")
  set(HOST_LINUX 1)
  add_definitions(-D_GNU_SOURCE -D_REENTRANT)
  add_definitions(-D_THREAD_SAFE)
elseif(CMAKE_SYSTEM_NAME STREQUAL "Android")
  set(HOST_LINUX 1)
  add_definitions(-D_GNU_SOURCE -D_REENTRANT)
  add_definitions(-D_THREAD_SAFE)
  add_compile_options(-Wl,-z,now)
  add_compile_options(-Wl,-z,relro)
  add_compile_options(-Wl,-z,noexecstack)

so it does use -z now on Android but not on Linux for some reason.

[uweigand]

CC @steveisok @directhex @akoeplinger