RFC: Turning executable stack warnings into errors

  Hi Guys,

  I am working on a patch to turn the linker's warning messages about
  executable stacks into errors.  My intent is to use this to force
  programs that currently do have an executable stack to either change
  or deliberately disable the errors from the linker.  The plan is to
  then use this feature to help improve the security of Fedora
  binaries.

  I realise that the --fatal-warnings option could basically do the same
  thing, but that might be problematic for builds where some linker
  warnings are inevitable and can be safely ignored.  Hence I decided on
  a new command line option instead.
  
  The patch currently has these features:

  * The change is configurable, but not on by default.
  
  * There are new command line options to turn the future on and off as
    well as an option to only generate warnings (or errors) if an object
    file requests an executable stack, and not if one is requested via
    the '-z execstack' command line option.
    
  * A similar change is also made for the executable segments warning,
    creating the ability to turn it into an error as well.

  * Since linker errors cannot be ignored when running the linker
    testsuite the patch also needs to enhance a fair number of tests so
    that they do not fail if run with a linker configured to generate
    errors by default.

  Patch attached below.  Any comments ?

Cheers
  Nick
  

Nick Clifton <nickc@redhat.com> writes:

> Hi Guys,
>
>   I am working on a patch to turn the linker's warning messages about
>   executable stacks into errors.  My intent is to use this to force
>   programs that currently do have an executable stack to either change
>   or deliberately disable the errors from the linker.  The plan is to
>   then use this feature to help improve the security of Fedora
>   binaries.

Thanks for working on this, Nick. We've had our own QA warnings in
Gentoo for a long time with scanelf from pax-utils and there's few
packages remaining with any sort of issue like this - and those which
remain are usually a JIT or similar and just need to opt-in (in fact,
they might already be doing so - our check doesn't look for that, we
have a custom mechanism to silence FPs, so..).

Making textrels an error by default has gone well for us as well
(pretty small fallout given we were warning on it for a while
downstream:
https://bugs.gentoo.org/showdependencytree.cgi?id=911581&hide_resolved=0),
so might be worth coming back to that soon.

>
>   I realise that the --fatal-warnings option could basically do the same
>   thing, but that might be problematic for builds where some linker
>   warnings are inevitable and can be safely ignored.  Hence I decided on
>   a new command line option instead.
>   
>   The patch currently has these features:
>
>   * The change is configurable, but not on by default.

I think this part is up to you but it's easier if it's on by default for
two reasons:
1) It's confusing if some distributions decide to turn it on and some
don't (and it makes life easier for distributions if upstreams are more
likely to be building with a version which has it on - both for bug
reports & having this stuff get fixed);

2) For the textrel check, the configure logic is a bit flawed because if
a distribution tries to opt-in, it'll override whatever the arch default
is where sometimes we need TEXTRELs (see https://sourceware.org/bugzilla/show_bug.cgi?id=29592),
I don't think that applies here but it's something we should keep in mind.

>   
>   * There are new command line options to turn the future on and off as
>     well as an option to only generate warnings (or errors) if an object
>     file requests an executable stack, and not if one is requested via
>     the '-z execstack' command line option.
>     
>   * A similar change is also made for the executable segments warning,
>     creating the ability to turn it into an error as well.
>
>   * Since linker errors cannot be ignored when running the linker
>     testsuite the patch also needs to enhance a fair number of tests so
>     that they do not fail if run with a linker configured to generate
>     errors by default.
>
>   Patch attached below.  Any comments ?
>
> Cheers
>   Nick
>
> diff --git a/bfd/elf.c b/bfd/elf.c
> index b5b0c69e097..bca7654053a 100644
> --- a/bfd/elf.c
> +++ b/bfd/elf.c
> @@ -7010,6 +7010,9 @@ assign_file_positions_except_relocs (bfd *abfd,
>      {
>        if (link_info != NULL && ! link_info->no_warn_rwx_segments)
>  	{
> +	  bool warned_tls = false;
> +	  bool warned_rwx = false;
> +
>  	  /* Memory resident segments with non-zero size and RWX
>  	     permissions are a security risk, so we generate a warning
>  	     here if we are creating any.  */
> @@ -7022,16 +7025,47 @@ assign_file_positions_except_relocs (bfd *abfd,
>  	      if (phdr->p_memsz == 0)
>  		continue;
>  
> -	      if (phdr->p_type == PT_TLS && (phdr->p_flags & PF_X))
> -		_bfd_error_handler (_("warning: %pB has a TLS segment"
> -				      " with execute permission"),
> -				    abfd);
> -	      else if (phdr->p_type == PT_LOAD
> +	      if (! warned_tls
> +		  && phdr->p_type == PT_TLS
> +		  && (phdr->p_flags & PF_X))
> +		{
> +		  if (link_info->warn_is_error_for_rwx_segments)
> +		    {
> +		      _bfd_error_handler (_("\
> +error: %pB has a TLS segment with execute permission"),
> +					  abfd);
> +		      return false;
> +		    }
> +
> +		  _bfd_error_handler (_("\
> +warning: %pB has a TLS segment with execute permission"),
> +				      abfd);
> +		  if (warned_rwx)
> +		    break;
> +
> +		  warned_tls = true;
> +		}
> +	      else if (! warned_rwx
> +		       && phdr->p_type == PT_LOAD
>  		       && ((phdr->p_flags & (PF_R | PF_W | PF_X))
>  			   == (PF_R | PF_W | PF_X)))
> -		_bfd_error_handler (_("warning: %pB has a LOAD segment"
> -				      " with RWX permissions"),
> -				    abfd);
> +		{
> +		  if (link_info->warn_is_error_for_rwx_segments)
> +		    {
> +		      _bfd_error_handler (_("\
> +error: %pB has a LOAD segment with RWX permissions"),
> +					  abfd);
> +		      return false;
> +		    }
> +
> +		  _bfd_error_handler (_("\
> +warning: %pB has a LOAD segment with RWX permissions"),
> +				      abfd);
> +		  if (warned_tls)
> +		    break;
> +
> +		  warned_rwx = true;
> +		}
>  	    }
>  	}
>  
> diff --git a/bfd/elflink.c b/bfd/elflink.c
> index 99f4cdd5527..49ea222ec77 100644
> --- a/bfd/elflink.c
> +++ b/bfd/elflink.c
> @@ -7152,9 +7152,20 @@ bfd_elf_size_dynamic_sections (bfd *output_bfd,
>        /* If the user has explicitly requested warnings, then generate one even
>  	 though the choice is the result of another command line option.  */
>        if (info->warn_execstack == 1)
> -	_bfd_error_handler
> -	  (_("\
> +	{
> +	  if (info->error_execstack)
> +	    {
> +	      _bfd_error_handler
> +		(_("\
> +error: creating an executable stack because of -z execstack command line option"));
> +	      return false;
> +	    }
> +
> +	  _bfd_error_handler
> +	    (_("\
>  warning: enabling an executable stack because of -z execstack command line option"));
> +	}
> +
>        elf_stack_flags (output_bfd) = PF_R | PF_W | PF_X;
>      }
>    else if (info->noexecstack)
> @@ -7210,11 +7221,29 @@ warning: enabling an executable stack because of -z execstack command line optio
>  		     being enabled despite the fact that it was not requested
>  		     on the command line.  */
>  		  if (noteobj)
> -		    _bfd_error_handler (_("\
> +		    {
> +		      if (info->error_execstack)
> +			{
> +			  _bfd_error_handler (_("\
> +error: %s: is triggering the generation of an executable stack (because it has an executable .note.GNU-stack section)"),
> +					      bfd_get_filename (noteobj));
> +			  return false;
> +			}
> +
> +		      _bfd_error_handler (_("\
>  warning: %s: requires executable stack (because the .note.GNU-stack section is executable)"),
>  		       bfd_get_filename (noteobj));
> +		    }
>  		  else if (emptyobj)
>  		    {
> +		      if (info->error_execstack)
> +			{
> +			  _bfd_error_handler (_("\
> +error: %s: is triggering the generation of an executable stack because it does not have a .note.GNU-stack section"),
> +					      bfd_get_filename (emptyobj));
> +			  return false;
> +			}
> +
>  		      _bfd_error_handler (_("\
>  warning: %s: missing .note.GNU-stack section implies executable stack"),
>  					  bfd_get_filename (emptyobj));
> diff --git a/include/bfdlink.h b/include/bfdlink.h
> index 840790a298c..8882257c632 100644
> --- a/include/bfdlink.h
> +++ b/include/bfdlink.h
> @@ -484,26 +484,49 @@ struct bfd_link_info
>       --dynamic-list command line options.  */
>    unsigned int dynamic: 1;
>  
> -  /* TRUE if PT_GNU_STACK segment should be created with PF_R|PF_W|PF_X
> -     flags.  */
> +  /* Set if the "-z execstack" option has been used to request that a
> +     PT_GNU_STACK segment should be created with PF_R, PF_W and PF_X
> +     flags set.
> +
> +     Note - if performing a relocatable link then a .note.GNU-stack
> +     section will be created instead, if one does not exist already.
> +     The section will have the SHF_EXECINSTR flag bit set.  */
>    unsigned int execstack: 1;
>  
> -  /* TRUE if PT_GNU_STACK segment should be created with PF_R|PF_W
> -     flags.  */
> +  /* Set if the "-z noexecstack" option has been used to request that a
> +     PT_GNU_STACK segment should be created with PF_R and PF_W flags.  Or
> +     a non-executable .note.GNU-stack section for relocateable links.
> +
> +     Note - this flag is not quite orthogonal to execstack, since both
> +     of these flags can be 0.  In this case a stack segment can still
> +     be created, but it will only have the PF_X flag bit set if one or
> +     more of the input files contains a .note.GNU-stack section with the
> +     SHF_EXECINSTR flag bit set, or if the default behaviour for the
> +     architecture is to create executable stacks.
> +
> +     The execstack and noexecstack flags should never both be 1.  */
>    unsigned int noexecstack: 1;
>  
>    /* Tri-state variable:
>       0 => do not warn when creating an executable stack.
> -     1 => always warn when creating an executable stack.
> -     >1 => warn when creating an executable stack if execstack is 0.  */
> +     1 => always warn when creating an executable stack (for any reason).
> +     2 => only warn when an executable stack has been requested an object
> +          file and execstack is 0 or noexecstack is 1.

It might just be me, but wonder if a table or something might be useful
here in a comment.

For =1, I suppose the intent there is for the benefit of SELinux (where
policies deny it by default for us at least) or to find misbehaviour by
upstreams?

What's the intent for =2?

(I realise this is kind of addressed by the texi changes below after
writing this, but it might still be useful to have a table in the texi,
I dunno)

> +     3 => not used.  */
>    unsigned int warn_execstack: 2;
> +  /* TRUE if a warning generated because of warn_execstack should be instead
> +     be treated as an error.  */
> +  unsigned int error_execstack: 1;
>  
> -  /* TRUE if warnings should not be generated for TLS segments with eXecute
> +  /* TRUE if warnings should NOT be generated for TLS segments with eXecute
>       permission or LOAD segments with RWX permissions.  */
>    unsigned int no_warn_rwx_segments: 1;
>    /* TRUE if the user gave either --warn-rwx-segments or
> -     --no-warn-rwx-segments.  */
> +     --no-warn-rwx-segments on the linker command line.  */
>    unsigned int user_warn_rwx_segments: 1;
> +  /* TRUE if warnings generated when no_warn_rwx_segements is 0 should
> +     instead be treated as errors.  */
> +  unsigned int warn_is_error_for_rwx_segments: 1;
>  
>    /* TRUE if the stack can be made executable because of the absence of a
>       .note.GNU-stack section in an input file.  Note - even if this field
> diff --git a/ld/NEWS b/ld/NEWS
> index 4b990c755f4..6671b65c27b 100644
> --- a/ld/NEWS
> +++ b/ld/NEWS
> @@ -1,5 +1,14 @@
>  -*- text -*-
>  
> +* Added --warn-execstack-objects to warn about executable stacks only when an
> +  input object file requests one.  Also added --error-execstack and
> +  --error-rxw-segments options to convert warnings about executable stacks and
> +  segments into errors.

rwx, not rxw?

> +
> +  Also added --enable-error-execstack=[yes|no] and
> +  --enable-error-rwx-segments=[yes|no] configure options to set the default for
> +  converting warnings into errors.
> +
>  Changes in 2.41:
>  
>  * Add support for the KVX instruction set.
> diff --git a/ld/config.in b/ld/config.in
> index a453c7f7241..e3a983fe3b0 100644
> --- a/ld/config.in
> +++ b/ld/config.in
> @@ -19,6 +19,14 @@
>  /* Define if you want compressed debug sections by default. */
>  #undef DEFAULT_FLAG_COMPRESS_DEBUG
>  
> +/* Define to 1 if you want to turn executable stack warnings into errors by
> +   default. */
> +#undef DEFAULT_LD_ERROR_EXECSTACK
> +
> +/* Define to 1 if you want to turn executable segment warnings into errors by
> +   default. */
> +#undef DEFAULT_LD_ERROR_RWX_SEGMENTS
> +
>  /* Define to 0 if you want to disable the generation of an executable stack
>     when a .note-GNU-stack section is missing. */
>  #undef DEFAULT_LD_EXECSTACK
> diff --git a/ld/configure b/ld/configure
> index d2cdf256b89..46d9f3c7111 100755
> --- a/ld/configure
> +++ b/ld/configure
> @@ -847,7 +847,9 @@ enable_relro
>  enable_textrel_check
>  enable_separate_code
>  enable_warn_execstack
> +enable_error_execstack
>  enable_warn_rwx_segments
> +enable_error_rwx_segments
>  enable_default_execstack
>  enable_error_handling_script
>  enable_default_hash_style
> @@ -1534,9 +1536,13 @@ Optional Features:
>                            enable DT_TEXTREL check in ELF linker
>    --enable-separate-code  enable -z separate-code in ELF linker by default
>    --enable-warn-execstack enable warnings when creating an executable stack
> +  --enable-error-execstack
> +                          turn executable stack warnings into errors
>    --enable-warn-rwx-segments
>                            enable warnings when creating segments with RWX
>                            permissions
> +  --enable-error-rwx-segments
> +                          turn executable segment warnings into errors
>    --enable-default-execstack
>                            create an executable stack if an input file is
>                            missing a .note.GNU-stack section
> @@ -11655,7 +11661,7 @@ else
>    lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
>    lt_status=$lt_dlunknown
>    cat > conftest.$ac_ext <<_LT_EOF
> -#line 11658 "configure"
> +#line 11664 "configure"
>  #include "confdefs.h"
>  
>  #if HAVE_DLFCN_H
> @@ -11761,7 +11767,7 @@ else
>    lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
>    lt_status=$lt_dlunknown
>    cat > conftest.$ac_ext <<_LT_EOF
> -#line 11764 "configure"
> +#line 11770 "configure"
>  #include "confdefs.h"
>  
>  #if HAVE_DLFCN_H
> @@ -15669,6 +15675,16 @@ esac
>  fi
>  
>  
> +ac_default_ld_error_execstack=0
> +# Check whether --enable-error-execstack was given.
> +if test "${enable_error_execstack+set}" = set; then :
> +  enableval=$enable_error_execstack; case "${enableval}" in
> +  yes) ac_default_ld_error_execstack=1 ;;
> +  no)  ac_default_ld_error_execstack=0 ;;
> +esac
> +fi
> +
> +
>  ac_default_ld_warn_rwx_segments=unset
>  # Check whether --enable-warn-rwx-segments was given.
>  if test "${enable_warn_rwx_segments+set}" = set; then :
> @@ -15679,6 +15695,16 @@ esac
>  fi
>  
>  
> +ac_default_ld_error_rwx_segments=0
> +# Check whether --enable-error-rwx-segments was given.
> +if test "${enable_error_rwx_segments+set}" = set; then :
> +  enableval=$enable_error_rwx_segments; case "${enableval}" in
> +  yes) ac_default_ld_error_rwx_segments=1 ;;
> +  no)  ac_default_ld_error_rwx_segments=0 ;;
> +esac
> +fi
> +
> +
>  ac_default_ld_default_execstack=unset
>  # Check whether --enable-default-execstack was given.
>  if test "${enable_default_execstack+set}" = set; then :
> @@ -17444,6 +17470,12 @@ cat >>confdefs.h <<_ACEOF
>  _ACEOF
>  
>  
> +
> +cat >>confdefs.h <<_ACEOF
> +#define DEFAULT_LD_ERROR_EXECSTACK $ac_default_ld_error_execstack
> +_ACEOF
> +
> +
>  if test "${ac_default_ld_warn_rwx_segments}" = unset; then
>    ac_default_ld_warn_rwx_segments=1
>  fi
> @@ -17453,6 +17485,12 @@ cat >>confdefs.h <<_ACEOF
>  _ACEOF
>  
>  
> +
> +cat >>confdefs.h <<_ACEOF
> +#define DEFAULT_LD_ERROR_RWX_SEGMENTS $ac_default_ld_error_rwx_segments
> +_ACEOF
> +
> +
>  if test "${ac_default_ld_default_execstack}" = unset; then
>    ac_default_ld_default_execstack=1
>  fi
> diff --git a/ld/configure.ac b/ld/configure.ac
> index c3ebd3ec7e4..cdac7bb0d74 100644
> --- a/ld/configure.ac
> +++ b/ld/configure.ac
> @@ -225,6 +225,15 @@ AC_ARG_ENABLE(warn-execstack,
>    no)  ac_default_ld_warn_execstack=0 ;;
>  esac])
>  
> +ac_default_ld_error_execstack=0
> +AC_ARG_ENABLE(error-execstack,
> +	      AS_HELP_STRING([--enable-error-execstack],
> +	      [turn executable stack warnings into errors]),
> +[case "${enableval}" in
> +  yes) ac_default_ld_error_execstack=1 ;;
> +  no)  ac_default_ld_error_execstack=0 ;;
> +esac])
> +
>  ac_default_ld_warn_rwx_segments=unset
>  AC_ARG_ENABLE(warn-rwx-segments,
>  	      AS_HELP_STRING([--enable-warn-rwx-segments],
> @@ -234,6 +243,15 @@ AC_ARG_ENABLE(warn-rwx-segments,
>    no)  ac_default_ld_warn_rwx_segments=0 ;;
>  esac])
>  
> +ac_default_ld_error_rwx_segments=0
> +AC_ARG_ENABLE(error-rwx-segments,
> +	      AS_HELP_STRING([--enable-error-rwx-segments],
> +	      [turn executable segment warnings into errors]),
> +[case "${enableval}" in
> +  yes) ac_default_ld_error_rwx_segments=1 ;;
> +  no)  ac_default_ld_error_rwx_segments=0 ;;
> +esac])
> +
>  ac_default_ld_default_execstack=unset
>  AC_ARG_ENABLE(default-execstack,
>  	      AS_HELP_STRING([--enable-default-execstack],
> @@ -549,6 +567,10 @@ AC_DEFINE_UNQUOTED(DEFAULT_LD_WARN_EXECSTACK,
>    $ac_default_ld_warn_execstack,
>    [Define to 1 if you want to enable --warn-execstack in ELF linker by default.])
>  
> +AC_DEFINE_UNQUOTED(DEFAULT_LD_ERROR_EXECSTACK,
> +  $ac_default_ld_error_execstack,
> +  [Define to 1 if you want to turn executable stack warnings into errors by default.])
> +
>  if test "${ac_default_ld_warn_rwx_segments}" = unset; then
>    ac_default_ld_warn_rwx_segments=1
>  fi
> @@ -556,6 +578,10 @@ AC_DEFINE_UNQUOTED(DEFAULT_LD_WARN_RWX_SEGMENTS,
>    $ac_default_ld_warn_rwx_segments,
>    [Define to 0 if you want to disable --warn-rwx-segments in ELF linker by default.])
>  
> +AC_DEFINE_UNQUOTED(DEFAULT_LD_ERROR_RWX_SEGMENTS,
> +  $ac_default_ld_error_rwx_segments,
> +  [Define to 1 if you want to turn executable segment warnings into errors by default.])
> +
>  if test "${ac_default_ld_default_execstack}" = unset; then
>    ac_default_ld_default_execstack=1
>  fi
> diff --git a/ld/emultempl/elf.em b/ld/emultempl/elf.em
> index 1c5030d5e1c..0fb6226787f 100644
> --- a/ld/emultempl/elf.em
> +++ b/ld/emultempl/elf.em
> @@ -95,6 +95,8 @@ fragment <<EOF
>    link_info.warn_execstack = DEFAULT_LD_WARN_EXECSTACK;
>    link_info.no_warn_rwx_segments = ! DEFAULT_LD_WARN_RWX_SEGMENTS;
>    link_info.default_execstack = DEFAULT_LD_EXECSTACK;
> +  link_info.error_execstack = DEFAULT_LD_ERROR_EXECSTACK;
> +  link_info.warn_is_error_for_rwx_segments = DEFAULT_LD_ERROR_RWX_SEGMENTS;
>  }
>  
>  EOF
> diff --git a/ld/ld.texi b/ld/ld.texi
> index 600c9d62806..09a04008883 100644
> --- a/ld/ld.texi
> +++ b/ld/ld.texi
> @@ -2773,28 +2773,51 @@ detect the use of global constructors.
>  @cindex warnings, on executable stack
>  @cindex executable stack, warnings on
>  @item --warn-execstack
> +@itemx --warn-execstack-objects
>  @itemx --no-warn-execstack
> -On ELF platforms this option controls how the linker generates warning
> -messages when it creates an output file with an executable stack.  By
> -default the linker will not warn if the @command{-z execstack} command
> -line option has been used, but this behaviour can be overridden by the
> -@option{--warn-execstack} option.
> -
> -On the other hand the linker will normally warn if the stack is made
> -executable because one or more of the input files need an execuable
> -stack and neither of the @command{-z execstack} or @command{-z
> -noexecstack} command line options have been specified.  This warning
> -can be disabled via the @command{--no-warn-execstack} option.
> -
> -Note: ELF format input files specify that they need an executable
> +On ELF platforms the linker may generate warning messages if it is
> +asked to create an output file that contains an executable stack.
> +There are three possible states:
> +@enumerate
> +@item
> +Do not generate any warnings.
> +@item
> +Always generate warnings, even if the executable stack is requested
> +via the @option{-z execstack} command line option.
> +@item
> +Only generate a warning if an object file requests an executable
> +stack, but not if the @option{-z execstack} option is used.
> +@end enumerate
> +
> +The default state depends upon how the linker was configured when it
> +was built.  The @option{--no-warn-execstack} option always puts the
> +linker into the no-warnings state.  The @option{--warn-execstack}
> +option puts the linker into the warn-always state.  The
> +@option{--warn-execstack-objects} option puts the linker into the
> +warn-for-object-files-only state.
> +
> +Note: ELF format input files can specify that they need an executable
>  stack by having a @var{.note.GNU-stack} section with the executable
>  bit set in its section flags.  They can specify that they do not need
> -an executable stack by having that section, but without the executable
> -flag bit set.  If an input file does not have a @var{.note.GNU-stack}
> -section present then the default behaviour is target specific.  For
> -some targets, then absence of such a section implies that an
> -executable stack @emph{is} required.  This is often a problem for hand
> -crafted assembler files.
> +an executable stack by having the same section, but without the
> +executable flag bit set.  If an input file does not have a
> +@var{.note.GNU-stack} section then the default behaviour is target
> +specific.  For some targets, then absence of such a section implies
> +that an executable stack @emph{is} required.  This is often a problem
> +for hand crafted assembler files.
> +
> +@kindex --error-execstack
> +@item --error-execstack
> +@itemx --no-error-execstack
> +If the linker is going to generate a warning message about an
> +executable stack then the @option{--error-execstack} option will
> +instead change that warning into an error.  Note - this option does
> +not change the linker's execstack warning generation state.  Use
> +@option{--warn-execstack} or @option{--warn-execstack-objects} to set
> +a specific warning state.
> +
> +The @option{--no-error-execstack} option will restore the default
> +behaviour of generating warning messages.
>  
>  @kindex --warn-multiple-gp
>  @item --warn-multiple-gp
> @@ -2833,6 +2856,20 @@ These warnings are enabled by default.  They can be disabled via the
>  @option{--no-warn-rwx-segments} option and re-enabled via the
>  @option{--warn-rwx-segments} option.
>  
> +@kindex --error-rwx-segments
> +@item --error-rwx-segments
> +@itemx --no-error-rwx-segments
> +If the linker is going to generate a warning message about an
> +executable, writeable segment, or an executable TLS segment, then the
> +@option{--error-rwx-segments} option will turn this warning into an
> +error instead.  The @option{--no-error-rwx-segments} option will
> +restore the default behaviour of just generating a warning message.
> +
> +Note - the @option{--error-rwx-segments} option does not by itself
> +turn on warnings about these segments.  These warnings are either
> +enabled by default, if the linker was configured that way, or via the
> +@option{--warn-rwx-segments} command line option.
> +
>  @kindex --warn-section-align
>  @cindex warnings, on section alignment
>  @cindex section alignment, warnings on
> diff --git a/ld/ldlex.h b/ld/ldlex.h
> index 87cac02141d..c000d1e2939 100644
> --- a/ld/ldlex.h
> +++ b/ld/ldlex.h
> @@ -168,10 +168,15 @@ enum option_values
>    OPTION_CTF_VARIABLES,
>    OPTION_NO_CTF_VARIABLES,
>    OPTION_CTF_SHARE_TYPES,
> +  OPTION_ERROR_EXECSTACK,
> +  OPTION_NO_ERROR_EXECSTACK,
> +  OPTION_WARN_EXECSTACK_OBJECTS,
>    OPTION_WARN_EXECSTACK,
>    OPTION_NO_WARN_EXECSTACK,
>    OPTION_WARN_RWX_SEGMENTS,
>    OPTION_NO_WARN_RWX_SEGMENTS,
> +  OPTION_ERROR_RWX_SEGMENTS,
> +  OPTION_NO_ERROR_RWX_SEGMENTS,
>    OPTION_ENABLE_LINKER_VERSION,
>    OPTION_DISABLE_LINKER_VERSION,
>    OPTION_REMAP_INPUTS,
> diff --git a/ld/lexsup.c b/ld/lexsup.c
> index 49dfc13382a..aa4c76ec281 100644
> --- a/ld/lexsup.c
> +++ b/ld/lexsup.c
> @@ -551,14 +551,27 @@ static const struct ld_option ld_options[] =
>    { {"warn-constructors", no_argument, NULL, OPTION_WARN_CONSTRUCTORS},
>      '\0', NULL, N_("Warn if global constructors/destructors are seen"),
>      TWO_DASHES },
> +
> +  { {"error-execstack", no_argument, NULL, OPTION_ERROR_EXECSTACK},
> +    '\0', NULL, NULL, TWO_DASHES },
> +  { {"no-error-execstack", no_argument, NULL, OPTION_NO_ERROR_EXECSTACK},
> +    '\0', NULL, NULL, TWO_DASHES },
> +  { {"warn-execstack-objects", no_argument, NULL, OPTION_WARN_EXECSTACK_OBJECTS},
> +    '\0', NULL, NULL, TWO_DASHES },
>    { {"warn-execstack", no_argument, NULL, OPTION_WARN_EXECSTACK},
> -    '\0', NULL, N_("Warn when creating an executable stack"), TWO_DASHES },
> +    '\0', NULL, NULL, TWO_DASHES },
>    { {"no-warn-execstack", no_argument, NULL, OPTION_NO_WARN_EXECSTACK},
> -    '\0', NULL, N_("Do not warn when creating an executable stack"), TWO_DASHES },
> +    '\0', NULL, NULL, TWO_DASHES },
> +
> +  { {"error-rwx-segments", no_argument, NULL, OPTION_ERROR_RWX_SEGMENTS},
> +    '\0', NULL, NULL, TWO_DASHES },
> +  { {"no-error-rwx-segments", no_argument, NULL, OPTION_NO_ERROR_RWX_SEGMENTS},
> +    '\0', NULL, NULL, TWO_DASHES },
>    { {"warn-rwx-segments", no_argument, NULL, OPTION_WARN_RWX_SEGMENTS},
> -    '\0', NULL, N_("Warn when creating executable segments"), TWO_DASHES },
> +    '\0', NULL, NULL, TWO_DASHES },
>    { {"no-warn-rwx-segments", no_argument, NULL, OPTION_NO_WARN_RWX_SEGMENTS},
> -    '\0', NULL, N_("Do not warn when creating executable segments"), TWO_DASHES },
> +    '\0', NULL, NULL, TWO_DASHES },
> +
>    { {"warn-multiple-gp", no_argument, NULL, OPTION_WARN_MULTIPLE_GP},
>      '\0', NULL, N_("Warn if the multiple GP values are used"), TWO_DASHES },
>    { {"warn-once", no_argument, NULL, OPTION_WARN_ONCE},
> @@ -944,12 +957,29 @@ parse_args (unsigned argc, char **argv)
>  	case OPTION_NON_CONTIGUOUS_REGIONS_WARNINGS:
>  	  link_info.non_contiguous_regions_warnings = true;
>  	  break;
> +
> +	case OPTION_ERROR_EXECSTACK:
> +	  link_info.error_execstack = 1;
> +	  break;
> +	case OPTION_NO_ERROR_EXECSTACK:
> +	  link_info.error_execstack = 0;
> +	  break;
> +	case OPTION_WARN_EXECSTACK_OBJECTS:
> +	  link_info.warn_execstack = 2;
> +	  break;
>  	case OPTION_WARN_EXECSTACK:
>  	  link_info.warn_execstack = 1;
>  	  break;
>  	case OPTION_NO_WARN_EXECSTACK:
>  	  link_info.warn_execstack = 0;
>  	  break;
> +
> +	case OPTION_ERROR_RWX_SEGMENTS:
> +	  link_info.warn_is_error_for_rwx_segments = 1;
> +	  break;
> +	case OPTION_NO_ERROR_RWX_SEGMENTS:
> +	  link_info.warn_is_error_for_rwx_segments = 0;
> +	  break;
>  	case OPTION_WARN_RWX_SEGMENTS:
>  	  link_info.no_warn_rwx_segments = 0;
>  	  link_info.user_warn_rwx_segments = 1;
> @@ -958,6 +988,7 @@ parse_args (unsigned argc, char **argv)
>  	  link_info.no_warn_rwx_segments = 1;
>  	  link_info.user_warn_rwx_segments = 1;
>  	  break;
> +
>  	case 'e':
>  	  lang_add_entry (optarg, true);
>  	  break;
> @@ -2239,24 +2270,32 @@ elf_static_list_options (FILE *file)
>    -z muldefs                  Allow multiple definitions\n"));
>    fprintf (file, _("\
>    -z stack-size=SIZE          Set size of stack segment\n"));
> +
>    fprintf (file, _("\
>    -z execstack                Mark executable as requiring executable stack\n"));
>    fprintf (file, _("\
> -  -z noexecstack              Mark executable as not requiring executable stack\n"));
> -#if DEFAULT_LD_WARN_EXECSTACK == 1
> +  -z noexecstack              Mark executable as not requiring executable stack\n"));  
>    fprintf (file, _("\
> -  --warn-execstack            Generate a warning if the stack is executable (default)\n"));
> +  --warn-execstack-objects    Generate a warning if an object file requests an executable stack\n"));
> +#if DEFAULT_LD_WARN_EXECSTACK == 0
> +  fprintf (file, _("\
> +  --warn-execstack            Generate a warning if creating an executable stack\n"));
>  #else
>    fprintf (file, _("\
> -  --warn-execstack            Generate a warning if the stack is executable\n"));
> +  --warn-execstack            Generate a warning if creating an executable stack (default)\n"));
>  #endif
>  #if DEFAULT_LD_WARN_EXECSTACK == 0
>    fprintf (file, _("\
> -  --no-warn-execstack         Do not generate a warning if the stack is executable (default)\n"));
> +  --no-warn-execstack         Do not generate a warning if creating an executable stack (default)\n"));
>  #else
>    fprintf (file, _("\
> -  --no-warn-execstack         Do not generate a warning if the stack is executable\n"));
> +  --no-warn-execstack         Do not generate a warning if creating an executable stack\n"));
>  #endif
> +  fprintf (file, _("\
> +  --error-execstack           Turn warnings about executable stacks into errors\n"));
> +  fprintf (file, _("\
> +  --no-error-execstack         Do not turn warnings about executable stacks into errors\n"));
> +  
>  #if DEFAULT_LD_WARN_RWX_SEGMENTS
>    fprintf (file, _("\
>    --warn-rwx-segments         Generate a warning if a LOAD segment has RWX permissions (default)\n"));
> @@ -2268,6 +2307,11 @@ elf_static_list_options (FILE *file)
>    fprintf (file, _("\
>    --no-warn-rwx-segments      Do not generate a warning if a LOAD segments has RWX permissions (default)\n"));
>  #endif
> +  fprintf (file, _("\
> +  --error-rwx-segments        Turn warnings about loadable RWX segments into errors\n"));
> +  fprintf (file, _("\
> +  --no-error-rwx-segments     Do not turn warnings about loadable RWX segments into errors\n"));
> +
>    fprintf (file, _("\
>    -z unique-symbol            Avoid duplicated local symbol names\n"));
>    fprintf (file, _("\
> diff --git a/ld/testsuite/ld-elf/commonpage2.d b/ld/testsuite/ld-elf/commonpage2.d
> index e4d582bef60..ae585158930 100644
> --- a/ld/testsuite/ld-elf/commonpage2.d
> +++ b/ld/testsuite/ld-elf/commonpage2.d
> @@ -1,6 +1,6 @@
>  #source: maxpage1.s
>  #as: --32
> -#ld: -z max-page-size=0x200000 -z common-page-size=0x100000 -T maxpage4.t
> +#ld: -z max-page-size=0x200000 -z common-page-size=0x100000 -T maxpage4.t --no-warn-rwx-segments
>  #readelf: -l --wide
>  #target: x86_64-*-linux*
>  
> diff --git a/ld/testsuite/ld-elf/elf.exp b/ld/testsuite/ld-elf/elf.exp
> index 9e2c77d28b7..545d59f9f5f 100644
> --- a/ld/testsuite/ld-elf/elf.exp
> +++ b/ld/testsuite/ld-elf/elf.exp
> @@ -217,7 +217,7 @@ if {   [istarget *-*-*linux*]
>      || [istarget *-*-gnu*] } {
>      run_ld_link_tests [list \
>  	[list "stack exec" \
> -	    "-z execstack" \
> +	    "-z execstack --no-error-execstack" \
>  	    "" \
>  	    "" \
>  	    {stack.s} \
> @@ -264,14 +264,14 @@ if {   [istarget *-*-*linux*]
>      # of the first test by forcing the flags.
>      run_ld_link_tests [list \
>  	[list "PR ld/29072 (warn about an executable .note.GNU-stack)" \
> -	    "-e 0 --warn-execstack --warn-rwx-segments" \
> +	    "-e 0 --warn-execstack --warn-rwx-segments --no-error-rwx-segments --no-error-execstack" \
>  	    "" \
>  	    "" \
>  	    {pr29072-a.s} \
>  	    {{ld pr29072.a.warn}} \
>  	    "pr29072-a.exe"] \
>  	[list "PR 29072 (warn about -z execstack)" \
> -	    "-z execstack --warn-execstack" \
> +	    "-z execstack --warn-execstack --no-error-execstack" \
>  	    "" \
>  	    "" \
>  	    {stack.s} \
> @@ -285,14 +285,14 @@ if {   [istarget *-*-*linux*]
>  	    {} \
>  	    "pr29072-d.exe"] \
>  	[list "Ensure that a warning issued when creating a segment with RWX permissions" \
> -	    "-e 0 -Tnobits-1.t --warn-rwx-segments" \
> +	    "-e 0 -Tnobits-1.t --warn-rwx-segments --no-error-rwx-segments" \
>  	    "" \
>  	    "" \
>  	    {nobits-1.s} \
>  	     {{ld rwx-segments-1.l}} \
>  	    "rwx-segments-1.exe"] \
>  	[list "Ensure that a warning issued when creating a TLS segment with execute permission" \
> -	    "-e 0 -T rwx-segments-2.t --warn-rwx-segments" \
> +	    "-e 0 -T rwx-segments-2.t --warn-rwx-segments --no-error-rwx-segments" \
>  	    "" \
>  	    "" \
>  	    {size-2.s} \
> @@ -312,7 +312,7 @@ if {   [istarget *-*-*linux*]
>      if { [target_defaults_to_execstack] } {
>  	run_ld_link_tests [list \
>  	   [list "PR ld/29072 (warn about absent .note.GNU-stack)" \
> -	    "-e 0 -z stack-size=0x123400  --warn-execstack" \
> +	    "-e 0 -z stack-size=0x123400  --warn-execstack --no-error-execstack" \
>  	    "" \
>  	    "" \
>  	    {pr29072-b.s} \
> @@ -322,7 +322,7 @@ if {   [istarget *-*-*linux*]
>      } else {
>  	run_ld_link_tests [list \
>  	   [list "PR ld/29072 (ignore absent .note.GNU-stack)" \
> -	    "-e 0 -z stack-size=0x123400" \
> +	    "-e 0 -z stack-size=0x123400 --no-error-execstack" \
>  	    "" \
>  	    "" \
>  	    {pr29072-b.s} \
> diff --git a/ld/testsuite/ld-elf/header.d b/ld/testsuite/ld-elf/header.d
> index 67f0c981920..ade4f3a3dc8 100644
> --- a/ld/testsuite/ld-elf/header.d
> +++ b/ld/testsuite/ld-elf/header.d
> @@ -1,5 +1,5 @@
>  # target: *-*-linux* *-*-gnu* *-*-vxworks arm*-*-uclinuxfdpiceabi
> -# ld: -T header.t -z max-page-size=0x100 -z common-page-size=0x100
> +# ld: -T header.t -z max-page-size=0x100 -z common-page-size=0x100 --no-warn-rwx-segments
>  # objdump: -hpw
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/loadaddr1.d b/ld/testsuite/ld-elf/loadaddr1.d
> index 814afc13766..1418313cf9c 100644
> --- a/ld/testsuite/ld-elf/loadaddr1.d
> +++ b/ld/testsuite/ld-elf/loadaddr1.d
> @@ -1,5 +1,5 @@
>  #source: loadaddr.s
> -#ld: -T loadaddr1.t -T loadaddr.t -z max-page-size=0x200000 -z noseparate-code
> +#ld: -T loadaddr1.t -T loadaddr.t -z max-page-size=0x200000 -z noseparate-code --no-warn-rwx-segments
>  #readelf: -l --wide
>  #target: *-*-linux* *-*-gnu* arm*-*-uclinuxfdpiceabi
>  #xfail: h8300-*-* rx-*-linux*
> diff --git a/ld/testsuite/ld-elf/loadaddr2.d b/ld/testsuite/ld-elf/loadaddr2.d
> index 64843c2a7d4..357bbe5de7b 100644
> --- a/ld/testsuite/ld-elf/loadaddr2.d
> +++ b/ld/testsuite/ld-elf/loadaddr2.d
> @@ -1,5 +1,5 @@
>  #source: loadaddr.s
> -#ld: -T loadaddr2.t -T loadaddr.t -z max-page-size=0x200000 -z noseparate-code
> +#ld: -T loadaddr2.t -T loadaddr.t -z max-page-size=0x200000 -z noseparate-code --no-warn-rwx-segments
>  #readelf: -l --wide
>  #target: *-*-linux* *-*-gnu* arm*-*-uclinuxfdpiceabi
>  #xfail: h8300-*-* rx-*-linux*
> diff --git a/ld/testsuite/ld-elf/maxpage4.d b/ld/testsuite/ld-elf/maxpage4.d
> index a08e85660ab..f07c35f9d35 100644
> --- a/ld/testsuite/ld-elf/maxpage4.d
> +++ b/ld/testsuite/ld-elf/maxpage4.d
> @@ -1,6 +1,6 @@
>  #source: maxpage1.s
>  #as: --32
> -#ld: -z max-page-size=0x200000 -T maxpage4.t
> +#ld: -z max-page-size=0x200000 -T maxpage4.t --no-warn-rwx-segments
>  #readelf: -l --wide
>  #target: x86_64-*-linux* i?86-*-linux-gnu i?86-*-gnu*
>  
> diff --git a/ld/testsuite/ld-elf/nobits-1.d b/ld/testsuite/ld-elf/nobits-1.d
> index 9b90b6f76af..b869475d453 100644
> --- a/ld/testsuite/ld-elf/nobits-1.d
> +++ b/ld/testsuite/ld-elf/nobits-1.d
> @@ -1,4 +1,4 @@
> -#ld: -Tnobits-1.t
> +#ld: -Tnobits-1.t --no-warn-rwx-segments
>  #readelf: -l --wide
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/note-1.d b/ld/testsuite/ld-elf/note-1.d
> index a5fc40f2e69..ddf3606e516 100644
> --- a/ld/testsuite/ld-elf/note-1.d
> +++ b/ld/testsuite/ld-elf/note-1.d
> @@ -1,4 +1,4 @@
> -#ld: -Tnote-1.t
> +#ld: -Tnote-1.t --no-warn-rwx-segments
>  #readelf: -l --wide
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/orphan-10.d b/ld/testsuite/ld-elf/orphan-10.d
> index 8ad71c8a66f..330a4714374 100644
> --- a/ld/testsuite/ld-elf/orphan-10.d
> +++ b/ld/testsuite/ld-elf/orphan-10.d
> @@ -1,5 +1,5 @@
>  #source: orphan-10.s
> -#ld: -N -T orphan-9.ld
> +#ld: -N -T orphan-9.ld --no-warn-rwx-segments
>  #objdump: -h
>  #xfail: [uses_genelf]
>  
> diff --git a/ld/testsuite/ld-elf/orphan-11.d b/ld/testsuite/ld-elf/orphan-11.d
> index a9936f20fae..78b5042569f 100644
> --- a/ld/testsuite/ld-elf/orphan-11.d
> +++ b/ld/testsuite/ld-elf/orphan-11.d
> @@ -1,5 +1,5 @@
>  #source: orphan-11.s
> -#ld: -T orphan-11.ld --orphan-handling=error
> +#ld: -T orphan-11.ld --orphan-handling=error --no-warn-rwx-segments
>  #objdump: -wh
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/orphan-12.d b/ld/testsuite/ld-elf/orphan-12.d
> index b0d4c2f69d2..ab1a872d033 100644
> --- a/ld/testsuite/ld-elf/orphan-12.d
> +++ b/ld/testsuite/ld-elf/orphan-12.d
> @@ -1,5 +1,5 @@
>  #source: orphan-12.s
> -#ld: -T orphan-11.ld --strip-debug --orphan-handling=error
> +#ld: -T orphan-11.ld --strip-debug --orphan-handling=error --no-warn-rwx-segments
>  #objdump: -wh
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/orphan-5.d b/ld/testsuite/ld-elf/orphan-5.d
> index 4f99cd0d51e..4ad2dda3485 100644
> --- a/ld/testsuite/ld-elf/orphan-5.d
> +++ b/ld/testsuite/ld-elf/orphan-5.d
> @@ -1,4 +1,4 @@
>  #name: Report warning for orphan sections
> -#ld: --script orphan.ld --orphan-handling=warn
> +#ld: --script orphan.ld --orphan-handling=warn --no-warn-rwx-segments
>  #source: orphan.s
>  #warning_output: orphan-5.l
> diff --git a/ld/testsuite/ld-elf/orphan-7.d b/ld/testsuite/ld-elf/orphan-7.d
> index 01d6e8020fb..028f74b5b3b 100644
> --- a/ld/testsuite/ld-elf/orphan-7.d
> +++ b/ld/testsuite/ld-elf/orphan-7.d
> @@ -1,4 +1,4 @@
>  #name: Discard orphan sections
> -#ld: --script orphan.ld --orphan-handling=discard
> +#ld: --script orphan.ld --orphan-handling=discard --no-warn-rwx-segments
>  #source: orphan.s
>  #map: orphan-7.map
> diff --git a/ld/testsuite/ld-elf/orphan-8.d b/ld/testsuite/ld-elf/orphan-8.d
> index bbd7288dc8b..e7ba78ac283 100644
> --- a/ld/testsuite/ld-elf/orphan-8.d
> +++ b/ld/testsuite/ld-elf/orphan-8.d
> @@ -1,4 +1,4 @@
>  #name: Place orphan sections
> -#ld: --script orphan.ld --orphan-handling=place
> +#ld: --script orphan.ld --orphan-handling=place --no-warn-rwx-segments
>  #source: orphan.s
>  #map: orphan-8.map
> diff --git a/ld/testsuite/ld-elf/orphan-9.d b/ld/testsuite/ld-elf/orphan-9.d
> index 27efb81d015..5a8e8f18f80 100644
> --- a/ld/testsuite/ld-elf/orphan-9.d
> +++ b/ld/testsuite/ld-elf/orphan-9.d
> @@ -1,5 +1,5 @@
>  #source: orphan-9.s
> -#ld: -N -T orphan-9.ld
> +#ld: -N -T orphan-9.ld --no-warn-rwx-segments
>  #objdump: -h
>  #xfail: [uses_genelf]
>  
> diff --git a/ld/testsuite/ld-elf/orphan-region.d b/ld/testsuite/ld-elf/orphan-region.d
> index 1343574be68..3f5bfd75326 100644
> --- a/ld/testsuite/ld-elf/orphan-region.d
> +++ b/ld/testsuite/ld-elf/orphan-region.d
> @@ -1,5 +1,5 @@
>  #source: orphan-region.s
> -#ld: -T orphan-region.ld -N -z stack-size=0
> +#ld: -T orphan-region.ld -N -z stack-size=0 --no-warn-rwx-segments
>  #readelf: -S -l --wide
>  #xfail: [uses_genelf] hppa*64*-*-* spu-*-* *-*-nacl*
>  # if not using elf.em, you don't get fancy orphan handling
> diff --git a/ld/testsuite/ld-elf/orphan.d b/ld/testsuite/ld-elf/orphan.d
> index 9219cf70e1d..db0e93949af 100644
> --- a/ld/testsuite/ld-elf/orphan.d
> +++ b/ld/testsuite/ld-elf/orphan.d
> @@ -1,5 +1,5 @@
>  #source: orphan.s
> -#ld: -T orphan.ld
> +#ld: -T orphan.ld --no-warn-rwx-segments
>  #readelf: -S --wide
>  #xfail: [uses_genelf]
>  # if not using elf.em, you don't get fancy orphan handling
> diff --git a/ld/testsuite/ld-elf/pr19539.d b/ld/testsuite/ld-elf/pr19539.d
> index 99cfd9db917..f5de3b40c3d 100644
> --- a/ld/testsuite/ld-elf/pr19539.d
> +++ b/ld/testsuite/ld-elf/pr19539.d
> @@ -1,6 +1,6 @@
>  #source: start.s
>  #source: pr19539.s
> -#ld: -pie -T pr19539.t --warn-textrel
> +#ld: -pie -T pr19539.t --warn-textrel --no-warn-rwx-segments
>  #readelf : --dyn-syms --wide
>  #warning: .*: creating DT_TEXTREL in a PIE
>  #target: *-*-linux* *-*-gnu* *-*-solaris* arm*-*-uclinuxfdpiceabi
> diff --git a/ld/testsuite/ld-elf/pr26256-1a.d b/ld/testsuite/ld-elf/pr26256-1a.d
> index 025ace0e879..b8795c40712 100644
> --- a/ld/testsuite/ld-elf/pr26256-1a.d
> +++ b/ld/testsuite/ld-elf/pr26256-1a.d
> @@ -1,5 +1,5 @@
>  #source: pr26256-1.s
> -#ld: -e _start -T pr26256-1.t
> +#ld: -e _start -T pr26256-1.t --no-warn-rwx-segments
>  #nm: -n
>  
>  #...
> diff --git a/ld/testsuite/ld-elf/pr26907.d b/ld/testsuite/ld-elf/pr26907.d
> index 1efb8cc34b1..c046f65c97f 100644
> --- a/ld/testsuite/ld-elf/pr26907.d
> +++ b/ld/testsuite/ld-elf/pr26907.d
> @@ -1,4 +1,4 @@
> -#ld: -T pr26907.ld
> +#ld: -T pr26907.ld --no-warn-rwx-segments
>  #readelf: -lW
>  #xfail: dlx-*-* ft32-*-* h8300-*-* ip2k-*-* m32r*-*-elf* m32r*-*-rtems*
>  #xfail: moxie-*-* msp430-*-* mt-*-* pru*-*-* visium-*-*
> diff --git a/ld/testsuite/ld-elf/pr28597.d b/ld/testsuite/ld-elf/pr28597.d
> index 886182c120d..911e65251c9 100644
> --- a/ld/testsuite/ld-elf/pr28597.d
> +++ b/ld/testsuite/ld-elf/pr28597.d
> @@ -1,3 +1,3 @@
> -#ld: -shared -T pr28597.t
> +#ld: -shared -T pr28597.t --no-warn-rwx-segments
>  #error: .*: discarded output section: `.plt'
>  #target: i?86-*-* x86_64-*-*
> diff --git a/ld/testsuite/ld-elf/retain2.d b/ld/testsuite/ld-elf/retain2.d
> index 1a63f51aab5..1bd7aaf074d 100644
> --- a/ld/testsuite/ld-elf/retain2.d
> +++ b/ld/testsuite/ld-elf/retain2.d
> @@ -1,5 +1,5 @@
>  #name: SHF_GNU_RETAIN 2 (remove SHF_GNU_RETAIN sections by placing in /DISCARD/)
>  #source: retain1.s
> -#ld: -e _start -Map=retain2.map --gc-sections --script=retain2.ld
> +#ld: -e _start -Map=retain2.map --gc-sections --script=retain2.ld --no-warn-rwx-segments
>  #map: retain2.map
>  #notarget: ![supports_gnu_osabi] ![check_gc_sections_available]
> diff --git a/ld/testsuite/ld-elf/shared.exp b/ld/testsuite/ld-elf/shared.exp
> index 1e7b7f11cb0..a2b27f38be2 100644
> --- a/ld/testsuite/ld-elf/shared.exp
> +++ b/ld/testsuite/ld-elf/shared.exp
> @@ -259,13 +259,13 @@ if { [check_gc_sections_available] } {
>  	    "pr20828-v.so"] \
>  	[list \
>  	    "PR ld/20828 forcibly exported symbol version without section GC" \
> -	    "$LFLAGS --no-dynamic-linker -e foo -E -T pr20828-v.ld" "" "" \
> +	    "$LFLAGS --no-dynamic-linker -e foo -E -T pr20828-v.ld --no-error-rwx-segments" "" "" \
>  	    {pr20828-v.s} \
>  	    {{objdump -p pr20828-v.od}} \
>  	    "pr20828-v-1"] \
>  	[list \
>  	    "PR ld/20828 forcibly exported symbol version with section GC" \
> -	    "$LFLAGS --no-dynamic-linker -e foo --gc-sections -E -T pr20828-v.ld" "" "" \
> +	    "$LFLAGS --no-dynamic-linker -e foo --gc-sections -E -T pr20828-v.ld --no-error-rwx-segments" "" "" \
>  	    {pr20828-v.s} \
>  	    {{objdump -p pr20828-v.od}} \
>  	    "pr20828-v-2"]]
> @@ -282,7 +282,7 @@ if { [check_gc_sections_available] } {
>  	[list \
>  	    "PR ld/21233 dynamic symbols with section GC\
>  	     (auxiliary shared library)" \
> -	    "$LFLAGS -shared -T pr21233.ld" "" "$AFLAGS_PIC" \
> +	    "$LFLAGS -shared -T pr21233.ld --no-error-rwx-segments" "" "$AFLAGS_PIC" \
>  	    {pr21233-l.s} \
>  	    {{readelf --dyn-syms pr21233-l.sd}} \
>  	    "libpr21233.so"]]
> @@ -290,7 +290,7 @@ if { [check_gc_sections_available] } {
>      run_ld_link_tests [list \
>  	[list \
>  	    "PR ld/21233 dynamic symbols with section GC (--undefined)" \
> -	    "$LFLAGS --gc-sections -e foo --undefined=bar -T pr21233.ld" \
> +	    "$LFLAGS --gc-sections -e foo --undefined=bar -T pr21233.ld --no-error-rwx-segments" \
>  	    "tmpdir/libpr21233.so" "" \
>  	    {pr21233.s} \
>  	    {{readelf --dyn-syms pr21233.sd}} \
> @@ -300,7 +300,7 @@ if { [check_gc_sections_available] } {
>  	[list \
>  	    "PR ld/21233 dynamic symbols with section GC (--require-defined)" \
>  	    "$LFLAGS --gc-sections -e foo --require-defined=bar\
> -	     -T pr21233.ld" \
> +	     -T pr21233.ld --no-error-rwx-segments" \
>  	    "tmpdir/libpr21233.so" "" \
>  	    {pr21233.s} \
>  	    {{readelf --dyn-syms pr21233.sd}} \
> @@ -309,7 +309,7 @@ if { [check_gc_sections_available] } {
>      run_ld_link_tests [list \
>  	[list \
>  	    "PR ld/21233 dynamic symbols with section GC (EXTERN)" \
> -	    "$LFLAGS --gc-sections -e foo -T pr21233-e.ld" \
> +	    "$LFLAGS --gc-sections -e foo -T pr21233-e.ld --no-error-rwx-segments" \
>  	    "tmpdir/libpr21233.so" "" \
>  	    {pr21233.s} \
>  	    {{readelf --dyn-syms pr21233.sd}} \
> diff --git a/ld/testsuite/ld-elf/size-1.d b/ld/testsuite/ld-elf/size-1.d
> index a6f9f4f644a..3c1e282a31d 100644
> --- a/ld/testsuite/ld-elf/size-1.d
> +++ b/ld/testsuite/ld-elf/size-1.d
> @@ -1,5 +1,5 @@
>  #source: size-1.s
> -#ld: -T size-1.t
> +#ld: -T size-1.t --no-warn-rwx-segments
>  #objdump: -s
>  # v850 .tdata/.tbss are not TLS sections
>  #xfail: v850*-*-*
> diff --git a/ld/testsuite/ld-elf/textaddr7.d b/ld/testsuite/ld-elf/textaddr7.d
> index 89fcee63107..aa745348829 100644
> --- a/ld/testsuite/ld-elf/textaddr7.d
> +++ b/ld/testsuite/ld-elf/textaddr7.d
> @@ -1,5 +1,5 @@
>  #source: maxpage1.s
> -#ld: -n -z max-page-size=0x200000 -Ttext-segment 0x10000
> +#ld: -n -z max-page-size=0x200000 -Ttext-segment 0x10000 --no-warn-rwx-segments
>  #readelf: -l --wide
>  #target: *-*-linux-gnu *-*-gnu* arm*-*-uclinuxfdpiceabi
>  
> diff --git a/ld/testsuite/ld-elf/warn1.d b/ld/testsuite/ld-elf/warn1.d
> index 83076642b38..e8853036f14 100644
> --- a/ld/testsuite/ld-elf/warn1.d
> +++ b/ld/testsuite/ld-elf/warn1.d
> @@ -1,7 +1,7 @@
>  #source: start.s
>  #source: symbol1ref.s
>  #source: symbol1w.s
> -#ld: -T group.ld
> +#ld: -T group.ld --no-warn-rwx-segments
>  #warning: ^[^\n]*\): warning: witty one-liner$
>  #readelf: -s
>  #xfail: [is_generic]
> diff --git a/ld/testsuite/ld-elf/warn2.d b/ld/testsuite/ld-elf/warn2.d
> index 43743cd03b8..6cbffcafa0e 100644
> --- a/ld/testsuite/ld-elf/warn2.d
> +++ b/ld/testsuite/ld-elf/warn2.d
> @@ -1,7 +1,7 @@
>  #source: start.s
>  #source: symbol2ref.s
>  #source: symbol2w.s
> -#ld: -T group.ld
> +#ld: -T group.ld --no-warn-rwx-segments
>  #warning: ^[^\n]*\.[obj]+: warning: function 'Foo' used$
>  #readelf: -s
>  # if not using elf.em, you don't get fancy section handling
> diff --git a/ld/testsuite/ld-i386/discarded1.d b/ld/testsuite/ld-i386/discarded1.d
> index 8106db3e3c1..73e589a8f6e 100644
> --- a/ld/testsuite/ld-i386/discarded1.d
> +++ b/ld/testsuite/ld-i386/discarded1.d
> @@ -1,3 +1,3 @@
>  #as: --32
> -#ld: -melf_i386 -T discarded1.t
> +#ld: -melf_i386 -T discarded1.t --no-error-rwx-segments
>  #error: .*discarded output section: `.got.plt'
> diff --git a/ld/testsuite/ld-i386/pr19175.d b/ld/testsuite/ld-i386/pr19175.d
> index aaf929f2218..a65015e8150 100644
> --- a/ld/testsuite/ld-i386/pr19175.d
> +++ b/ld/testsuite/ld-i386/pr19175.d
> @@ -1,6 +1,6 @@
>  #source: pr19175.s
>  #as: --32 -mrelax-relocations=yes
> -#ld: -Bsymbolic -shared -melf_i386 -T pr19175.t
> +#ld: -Bsymbolic -shared -melf_i386 -T pr19175.t --no-error-rwx-segments
>  #objdump: -dw
>  
>  .*: +file format .*
> diff --git a/ld/testsuite/ld-i386/pr19539.d b/ld/testsuite/ld-i386/pr19539.d
> index f0644a3a84a..41c56f4defb 100644
> --- a/ld/testsuite/ld-i386/pr19539.d
> +++ b/ld/testsuite/ld-i386/pr19539.d
> @@ -1,5 +1,5 @@
>  #as: --32
> -#ld: -pie -m elf_i386 -T pr19539.t -z notext
> +#ld: -pie -m elf_i386 -T pr19539.t -z notext --no-error-rwx-segments
>  #readelf: -r --wide
>  
>  Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 1 entry:
> diff --git a/ld/testsuite/ld-i386/pr23189.d b/ld/testsuite/ld-i386/pr23189.d
> index d388830f614..3c3a665db4d 100644
> --- a/ld/testsuite/ld-i386/pr23189.d
> +++ b/ld/testsuite/ld-i386/pr23189.d
> @@ -1,5 +1,5 @@
>  #as: --32  -mrelax-relocations=yes
> -#ld: -shared -melf_i386 -T pr23189.t
> +#ld: -shared -melf_i386 -T pr23189.t --no-error-rwx-segments
>  #readelf: -r --wide
>  
>  There are no relocations in this file.
> diff --git a/ld/testsuite/ld-plugin/lto-3r.d b/ld/testsuite/ld-plugin/lto-3r.d
> index fd1bfd26867..43e25837224 100644
> --- a/ld/testsuite/ld-plugin/lto-3r.d
> +++ b/ld/testsuite/ld-plugin/lto-3r.d
> @@ -1,4 +1,4 @@
> -#ld: -r tmpdir/lto-3b.o
> +#ld: -r tmpdir/lto-3b.o --no-error-execstack
>  #source: dummy.s
>  #nm: -p
>  
> diff --git a/ld/testsuite/ld-plugin/lto-5r.d b/ld/testsuite/ld-plugin/lto-5r.d
> index c35e2bc338d..b53e355bc77 100644
> --- a/ld/testsuite/ld-plugin/lto-5r.d
> +++ b/ld/testsuite/ld-plugin/lto-5r.d
> @@ -1,4 +1,4 @@
> -#ld: -r tmpdir/lto-5a.o tmpdir/lto-5b.o
> +#ld: -r tmpdir/lto-5a.o tmpdir/lto-5b.o --no-error-execstack
>  #source: dummy.s
>  #nm: -p
>  
> diff --git a/ld/testsuite/ld-plugin/lto.exp b/ld/testsuite/ld-plugin/lto.exp
> index 6f728d77448..e71cf36ad62 100644
> --- a/ld/testsuite/ld-plugin/lto.exp
> +++ b/ld/testsuite/ld-plugin/lto.exp
> @@ -127,7 +127,7 @@ set lto_link_tests [list \
>     "" "-flto -O2 $lto_fat $NOSANITIZE_CFLAGS" \
>     {pr12758b.c} {} "libpr12758.a"] \
>    [list "PR ld/12758" \
> -   "$NOPIE_LDFLAGS $NOSANITIZE_CFLAGS -O2 -Wl,-e,foo -nostdlib -flto -fuse-linker-plugin tmpdir/pr12758a.o -Wl,--start-group tmpdir/libpr12758.a -Wl,--end-group" \
> +  "$NOPIE_LDFLAGS $NOSANITIZE_CFLAGS -O2 -Wl,-e,foo -nostdlib -flto -fuse-linker-plugin tmpdir/pr12758a.o -Wl,--start-group tmpdir/libpr12758.a -Wl,--end-group -Wl,--no-error-execstack" \
>     "$NOSANITIZE_CFLAGS" \
>     {dummy.c} {} "pr12758.exe"] \
>    [list "Build libpr13183.a" \
> @@ -919,7 +919,7 @@ run_cc_link_tests $lto_link_symbol_tests
>  
>  run_ld_link_tests [list \
>    [list "PR ld/19317 (2)" \
> -   "-r tmpdir/pr19317.o" "" "" \
> +   "-r tmpdir/pr19317.o --no-error-execstack" "" "" \
>     {dummy.s} {} "pr19317-r.o"] \
>  ]
>  
> diff --git a/ld/testsuite/ld-powerpc/ppc476-shared.d b/ld/testsuite/ld-powerpc/ppc476-shared.d
> index 3b2cc8a155c..44a9f59ca56 100644
> --- a/ld/testsuite/ld-powerpc/ppc476-shared.d
> +++ b/ld/testsuite/ld-powerpc/ppc476-shared.d
> @@ -1,6 +1,6 @@
>  #source: ppc476-shared.s
>  #as: -a32
> -#ld: -melf32ppc -q -shared -z common-page-size=0x10000 -z notext --ppc476-workaround -T ppc476-shared.lnk
> +#ld: -melf32ppc -q -shared -z common-page-size=0x10000 -z notext --ppc476-workaround -T ppc476-shared.lnk --no-error-rwx-segments
>  #objdump: -dr
>  #target: powerpc*-*-*
>  
> diff --git a/ld/testsuite/ld-powerpc/ppc476-shared2.d b/ld/testsuite/ld-powerpc/ppc476-shared2.d
> index 269e257608b..0cc83d98d38 100644
> --- a/ld/testsuite/ld-powerpc/ppc476-shared2.d
> +++ b/ld/testsuite/ld-powerpc/ppc476-shared2.d
> @@ -1,6 +1,6 @@
>  #source: ppc476-shared.s
>  #as: -a32
> -#ld: -melf32ppc -shared -z common-page-size=0x10000 -z notext --ppc476-workaround -T ppc476-shared.lnk
> +#ld: -melf32ppc -shared -z common-page-size=0x10000 -z notext --ppc476-workaround -T ppc476-shared.lnk --no-error-rwx-segments
>  #objdump: -R
>  #target: powerpc*-*-*
>  
> diff --git a/ld/testsuite/ld-powerpc/pr28827-2.d b/ld/testsuite/ld-powerpc/pr28827-2.d
> index 8da819d822a..063dca60468 100644
> --- a/ld/testsuite/ld-powerpc/pr28827-2.d
> +++ b/ld/testsuite/ld-powerpc/pr28827-2.d
> @@ -1,5 +1,5 @@
>  #as: -a64
> -#ld: -melf64ppc --plt-align=0 -T pr28827-2.lnk
> +#ld: -melf64ppc --plt-align=0 -T pr28827-2.lnk --no-error-rwx-segments
>  #objdump: -dr
>  
>  .*:     file format .*
> diff --git a/ld/testsuite/ld-s390/s390.exp b/ld/testsuite/ld-s390/s390.exp
> index ceaffd44989..823d8aa2897 100644
> --- a/ld/testsuite/ld-s390/s390.exp
> +++ b/ld/testsuite/ld-s390/s390.exp
> @@ -81,7 +81,7 @@ set s390xtests {
>       {{objdump -dzrj.text gotreloc_64-relro-1.dd}}
>       "gotreloc_64-1"}
>      {"PLT: offset test"
> -     "-shared -m elf64_s390 -dT pltoffset-1.ld" ""
> +     "-shared -m elf64_s390 -dT pltoffset-1.ld --no-error-rwx-segments" ""
>       "-m64" {pltoffset-1.s}
>       {{objdump "-dzrj.text --stop-address=16" pltoffset-1.dd}}
>       "pltoffset-1"}
> diff --git a/ld/testsuite/ld-scripts/align2a.d b/ld/testsuite/ld-scripts/align2a.d
> index 96237dd72f7..bf50c56bf6a 100644
> --- a/ld/testsuite/ld-scripts/align2a.d
> +++ b/ld/testsuite/ld-scripts/align2a.d
> @@ -1,4 +1,4 @@
> -# ld: --defsym data_align=16 -T align2.t
> +# ld: --defsym data_align=16 -T align2.t --no-error-rwx-segments
>  # objdump: --section-headers
>  
>  [^:]+: +file format.*
> diff --git a/ld/testsuite/ld-scripts/align2b.d b/ld/testsuite/ld-scripts/align2b.d
> index 05d2a156a0b..86a5f866978 100644
> --- a/ld/testsuite/ld-scripts/align2b.d
> +++ b/ld/testsuite/ld-scripts/align2b.d
> @@ -1,4 +1,4 @@
> -# ld: --defsym data_align=32 -T align2.t
> +# ld: --defsym data_align=32 -T align2.t --no-error-rwx-segments
>  # objdump: --section-headers
>  
>  [^:]+: +file +format.*
> diff --git a/ld/testsuite/ld-scripts/align5.d b/ld/testsuite/ld-scripts/align5.d
> index 880b6fbb014..40290b82ee7 100644
> --- a/ld/testsuite/ld-scripts/align5.d
> +++ b/ld/testsuite/ld-scripts/align5.d
> @@ -1,7 +1,7 @@
>  # source: align2a.s
> -# ld: -T align5.t
> +# ld: -T align5.t --no-error-rwx-segments
>  # nm: -n
>  
>  #...
>  .*foo
> -#...
> \ No newline at end of file
> +#...
> diff --git a/ld/testsuite/ld-scripts/alignof.exp b/ld/testsuite/ld-scripts/alignof.exp
> index 044ce376583..791dd616ddd 100644
> --- a/ld/testsuite/ld-scripts/alignof.exp
> +++ b/ld/testsuite/ld-scripts/alignof.exp
> @@ -39,7 +39,7 @@ if { [is_pecoff_format] } {
>  }
>  
>  if ![ld_link $ld tmpdir/alignof "-T $srcdir/$subdir/alignof.t \
> -	$IMAGE_BASE tmpdir/alignof.o"] {
> +	$IMAGE_BASE tmpdir/alignof.o --no-error-rwx-segments"] {
>      fail $testname
>      return
>  }
> diff --git a/ld/testsuite/ld-scripts/crossref.exp b/ld/testsuite/ld-scripts/crossref.exp
> index fdd5a3b0a59..50a4a733d47 100644
> --- a/ld/testsuite/ld-scripts/crossref.exp
> +++ b/ld/testsuite/ld-scripts/crossref.exp
> @@ -80,7 +80,7 @@ if [is_pecoff_format] {
>      append flags " --image-base 0"
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross1 -T $srcdir/$subdir/cross1.t tmpdir/cross1.o tmpdir/cross2.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross1 -T $srcdir/$subdir/cross1.t tmpdir/cross1.o tmpdir/cross2.o --no-error-rwx-segments"]
>  
>  set exec_output [prune_warnings $exec_output]
>  
> @@ -105,7 +105,7 @@ if { ![ld_compile "$CC_FOR_TARGET $NOSANITIZE_CFLAGS $NOLTO_CFLAGS" "$srcdir/$su
>      return
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross2 -T $srcdir/$subdir/cross2.t tmpdir/cross3.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross2 -T $srcdir/$subdir/cross2.t tmpdir/cross3.o --no-error-rwx-segments"]
>  set exec_output [prune_warnings $exec_output]
>  
>  regsub -all "(^|\n)($ld: warning: cannot find entry symbol\[^\n\]*\n?)" $exec_output "\\1" exec_output
> @@ -135,7 +135,7 @@ if ![ld_relocate $ld tmpdir/cross3-partial.o "tmpdir/cross1.o tmpdir/cross4.o"]
>      return
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross3 -T $srcdir/$subdir/cross3.t tmpdir/cross3-partial.o tmpdir/cross2.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross3 -T $srcdir/$subdir/cross3.t tmpdir/cross3-partial.o tmpdir/cross2.o --no-error-rwx-segments"]
>  
>  set exec_output [prune_warnings $exec_output]
>  
> @@ -148,7 +148,7 @@ if [string match "" $exec_output] then {
>      fail $test3
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross4 -T $srcdir/$subdir/cross4.t tmpdir/cross4.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross4 -T $srcdir/$subdir/cross4.t tmpdir/cross4.o --no-error-rwx-segments"]
>  set exec_output [prune_warnings $exec_output]
>  
>  regsub -all "(^|\n)($ld: warning: cannot find entry symbol\[^\n\]*\n?)" $exec_output "\\1" exec_output
> @@ -160,7 +160,7 @@ if [string match "" $exec_output] then {
>      fail $test4
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross5 -T $srcdir/$subdir/cross5.t tmpdir/cross4.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross5 -T $srcdir/$subdir/cross5.t tmpdir/cross4.o --no-error-rwx-segments"]
>  set exec_output [prune_warnings $exec_output]
>  
>  regsub -all "(^|\n)($ld: warning: cannot find entry symbol\[^\n\]*\n?)" $exec_output "\\1" exec_output
> @@ -176,7 +176,7 @@ if [string match "" $exec_output] then {
>      }
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross6 -T $srcdir/$subdir/cross6.t tmpdir/cross3.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross6 -T $srcdir/$subdir/cross6.t tmpdir/cross3.o --no-error-rwx-segments"]
>  set exec_output [prune_warnings $exec_output]
>  
>  regsub -all "(^|\n)($ld: warning: cannot find entry symbol\[^\n\]*\n?)" $exec_output "\\1" exec_output
> @@ -188,7 +188,7 @@ if [string match "" $exec_output] then {
>      fail $test6
>  }
>  
> -set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross7 -T $srcdir/$subdir/cross7.t tmpdir/cross3.o"]
> +set exec_output [run_host_cmd "$ld" "$flags -o tmpdir/cross7 -T $srcdir/$subdir/cross7.t tmpdir/cross3.o --no-error-rwx-segments"]
>  set exec_output [prune_warnings $exec_output]
>  
>  regsub -all "(^|\n)($ld: warning: cannot find entry symbol\[^\n\]*\n?)" $exec_output "\\1" exec_output
> diff --git a/ld/testsuite/ld-scripts/defined2.d b/ld/testsuite/ld-scripts/defined2.d
> index 6e6e068ce57..7508452e387 100644
> --- a/ld/testsuite/ld-scripts/defined2.d
> +++ b/ld/testsuite/ld-scripts/defined2.d
> @@ -1,4 +1,4 @@
> -#ld: -Tdefined2.t
> +#ld: -Tdefined2.t --no-error-rwx-segments
>  #nm: -B
>  #source: phdrs.s
>  
> diff --git a/ld/testsuite/ld-scripts/defined3.d b/ld/testsuite/ld-scripts/defined3.d
> index 0b3831c6fbd..805f724f947 100644
> --- a/ld/testsuite/ld-scripts/defined3.d
> +++ b/ld/testsuite/ld-scripts/defined3.d
> @@ -1,4 +1,4 @@
> -#ld: -Tdefined3.t
> +#ld: -Tdefined3.t --no-error-rwx-segments
>  #nm: -B
>  #source: phdrs.s
>  #source: defined.s
> diff --git a/ld/testsuite/ld-scripts/defined5.d b/ld/testsuite/ld-scripts/defined5.d
> index 97096f705f2..b5513ae9a5d 100644
> --- a/ld/testsuite/ld-scripts/defined5.d
> +++ b/ld/testsuite/ld-scripts/defined5.d
> @@ -1,4 +1,4 @@
> -#ld: -Tdefined5.t
> +#ld: -Tdefined5.t --no-error-rwx-segments
>  #warning: .*multiple definition of `defined'.*
>  #nm: -B
>  
> diff --git a/ld/testsuite/ld-scripts/pr14962.d b/ld/testsuite/ld-scripts/pr14962.d
> index 4c8e3707f7e..9bdd474eeb3 100644
> --- a/ld/testsuite/ld-scripts/pr14962.d
> +++ b/ld/testsuite/ld-scripts/pr14962.d
> @@ -1,4 +1,4 @@
> -#ld: -Ttext=0x1000 -Tdata=0x2000 -T pr14962.t
> +#ld: -Ttext=0x1000 -Tdata=0x2000 -T pr14962.t --no-error-rwx-segments
>  #source: pr14962a.s
>  #source: pr14962b.s
>  #nm: -n
> diff --git a/ld/testsuite/ld-scripts/pr18963.d b/ld/testsuite/ld-scripts/pr18963.d
> index bda3b063a45..e28129986fd 100644
> --- a/ld/testsuite/ld-scripts/pr18963.d
> +++ b/ld/testsuite/ld-scripts/pr18963.d
> @@ -1,5 +1,5 @@
>  # source: data.s
> -# ld: -T pr18963.t
> +# ld: -T pr18963.t --no-error-rwx-segments
>  # nm: -B -n
>  # notarget: *-*-vms
>  # Skip for VMS based targets as the linker automatically adds extra libraries that may not be present in a cross build.
> diff --git a/ld/testsuite/ld-scripts/pr20302.d b/ld/testsuite/ld-scripts/pr20302.d
> index 7eb25ce858d..03fa61d6bfd 100644
> --- a/ld/testsuite/ld-scripts/pr20302.d
> +++ b/ld/testsuite/ld-scripts/pr20302.d
> @@ -1,4 +1,4 @@
> -#ld: -Tdata=0x1000 -Tdata=0x2000 -Tcross2.t
> +#ld: -Tdata=0x1000 -Tdata=0x2000 -Tcross2.t --no-error-rwx-segments
>  #source: align2a.s
>  #objdump: -h
>  #notarget: *-*-*aout *-*-netbsd *-*-vms ns32k-*-* rx-*-*
> diff --git a/ld/testsuite/ld-scripts/print-memory-usage.exp b/ld/testsuite/ld-scripts/print-memory-usage.exp
> index 39000406ae3..897bf077910 100644
> --- a/ld/testsuite/ld-scripts/print-memory-usage.exp
> +++ b/ld/testsuite/ld-scripts/print-memory-usage.exp
> @@ -51,7 +51,7 @@ run_ld_link_tests {
>  
>      {
>  	"print-memory-usage-2"
> -	"-T print-memory-usage-2.t --print-memory-usage"
> +	"-T print-memory-usage-2.t --print-memory-usage --no-error-rwx-segments"
>  	""
>  	""
>  	{ "print-memory-usage-1.s" }
> diff --git a/ld/testsuite/ld-scripts/rgn-at1.d b/ld/testsuite/ld-scripts/rgn-at1.d
> index f301bbb6242..8069ac8cffd 100644
> --- a/ld/testsuite/ld-scripts/rgn-at1.d
> +++ b/ld/testsuite/ld-scripts/rgn-at1.d
> @@ -1,6 +1,6 @@
>  # name: rgn-at1
>  # source: rgn-at.s
> -# ld: -T rgn-at1.t
> +# ld: -T rgn-at1.t --no-error-rwx-segments
>  # objdump: -w -h
>  # xfail: rx-*-*
>  #   FAILS on the RX because the linker has to set LMA == VMA for the
> diff --git a/ld/testsuite/ld-scripts/rgn-at10.d b/ld/testsuite/ld-scripts/rgn-at10.d
> index dd52644634b..e11597ff784 100644
> --- a/ld/testsuite/ld-scripts/rgn-at10.d
> +++ b/ld/testsuite/ld-scripts/rgn-at10.d
> @@ -1,5 +1,5 @@
>  #source: rgn-at10.s
> -#ld: -T rgn-at10.t
> +#ld: -T rgn-at10.t --no-error-rwx-segments
>  #objdump: -h --wide
>  #xfail: hppa*64*-*-hpux* v850*-*-*
>  # Test that lma is adjusted in case the section start vma is aligned and
> diff --git a/ld/testsuite/ld-scripts/rgn-at4.d b/ld/testsuite/ld-scripts/rgn-at4.d
> index 98373433f06..3bf9e7b1aa7 100644
> --- a/ld/testsuite/ld-scripts/rgn-at4.d
> +++ b/ld/testsuite/ld-scripts/rgn-at4.d
> @@ -1,6 +1,6 @@
>  # name: rgn-at4
>  # source: rgn-at.s
> -# ld: -T rgn-at4.t
> +# ld: -T rgn-at4.t --no-error-rwx-segments
>  # objdump: -w -h
>  # xfail: rx-*-*
>  #   FAILS on the RX because the linker has to set LMA == VMA for the
> diff --git a/ld/testsuite/ld-scripts/rgn-at6.d b/ld/testsuite/ld-scripts/rgn-at6.d
> index c706faf8729..95fa0104e57 100644
> --- a/ld/testsuite/ld-scripts/rgn-at6.d
> +++ b/ld/testsuite/ld-scripts/rgn-at6.d
> @@ -1,5 +1,5 @@
>  #source: rgn-at6.s
> -#ld: -T rgn-at6.t
> +#ld: -T rgn-at6.t --no-error-rwx-segments
>  #objdump: -h --wide
>  # Test that lma is aligned as for vma when lma_region==region.
>  
> diff --git a/ld/testsuite/ld-scripts/rgn-at8.d b/ld/testsuite/ld-scripts/rgn-at8.d
> index 52725aa6248..e6ff29ab377 100644
> --- a/ld/testsuite/ld-scripts/rgn-at8.d
> +++ b/ld/testsuite/ld-scripts/rgn-at8.d
> @@ -1,5 +1,5 @@
>  #source: rgn-at6.s
> -#ld: -T rgn-at8.t
> +#ld: -T rgn-at8.t --no-error-rwx-segments
>  #objdump: -h --wide
>  # Test that lma is aligned when lma_region!=region and requested by script.
>  
> diff --git a/ld/testsuite/ld-scripts/rgn-at9.d b/ld/testsuite/ld-scripts/rgn-at9.d
> index e6384b451f3..02c16ed3ddf 100644
> --- a/ld/testsuite/ld-scripts/rgn-at9.d
> +++ b/ld/testsuite/ld-scripts/rgn-at9.d
> @@ -1,5 +1,5 @@
>  #source: rgn-at6.s
> -#ld: -T rgn-at9.t
> +#ld: -T rgn-at9.t --no-error-rwx-segments
>  #objdump: -h --wide
>  #xfail: rx-*-*
>  # Test that lma is adjusted in case the section start vma is aligned and
> diff --git a/ld/testsuite/ld-scripts/rgn-over1.d b/ld/testsuite/ld-scripts/rgn-over1.d
> index 902380ee98f..38341777a7c 100644
> --- a/ld/testsuite/ld-scripts/rgn-over1.d
> +++ b/ld/testsuite/ld-scripts/rgn-over1.d
> @@ -1,6 +1,6 @@
>  # name: rgn-over1
>  # source: rgn-over.s
> -# ld: -T rgn-over1.t -Map tmpdir/rgn-over1.map
> +# ld: -T rgn-over1.t -Map tmpdir/rgn-over1.map --no-error-rwx-segments
>  # error: \A[^ \n]*?ld[^:\n]*?: [^\n]*?section \`.text' will not fit in region `r1'\n[^ \n]*?ld[^:\n]*?: region `r1' overflowed by 16 bytes\Z
>  
>  #...
> diff --git a/ld/testsuite/ld-scripts/rgn-over2.d b/ld/testsuite/ld-scripts/rgn-over2.d
> index 1d7a8f93ac5..e2ff5a68367 100644
> --- a/ld/testsuite/ld-scripts/rgn-over2.d
> +++ b/ld/testsuite/ld-scripts/rgn-over2.d
> @@ -1,6 +1,6 @@
>  # name: rgn-over2
>  # source: rgn-over.s
> -# ld: -T rgn-over2.t -Map tmpdir/rgn-over2.map
> +# ld: -T rgn-over2.t -Map tmpdir/rgn-over2.map --no-error-rwx-segments
>  # error: \A[^ \n]*?ld[^:\n]*?: [^\n]*?section `\.data' will not fit in region `r1'\n[^ \n]*?ld[^:\n]*?: region `r1' overflowed by 4 bytes\Z
>  
>  #...
> diff --git a/ld/testsuite/ld-scripts/rgn-over4.d b/ld/testsuite/ld-scripts/rgn-over4.d
> index 8ae150dca5b..b8086f39f06 100644
> --- a/ld/testsuite/ld-scripts/rgn-over4.d
> +++ b/ld/testsuite/ld-scripts/rgn-over4.d
> @@ -1,6 +1,6 @@
>  # name: rgn-over4
>  # source: rgn-over.s
> -# ld: -T rgn-over4.t -Map tmpdir/rgn-over4.map
> +# ld: -T rgn-over4.t -Map tmpdir/rgn-over4.map --no-error-rwx-segments
>  # error: \A[^ \n]*?ld[^:\n]*?: [^:\n]*?section `\.text' will not fit in region `r1'\n[^ \n]*?ld[^:\n]*?: region `r1' overflowed by 16 bytes\Z
>  
>  #...
> diff --git a/ld/testsuite/ld-scripts/rgn-over5.d b/ld/testsuite/ld-scripts/rgn-over5.d
> index 10a7658534b..34e186dd126 100644
> --- a/ld/testsuite/ld-scripts/rgn-over5.d
> +++ b/ld/testsuite/ld-scripts/rgn-over5.d
> @@ -1,6 +1,6 @@
>  # name: rgn-over5
>  # source: rgn-over.s
> -# ld: -T rgn-over5.t -Map tmpdir/rgn-over5.map
> +# ld: -T rgn-over5.t -Map tmpdir/rgn-over5.map --no-error-rwx-segments
>  # error: \A[^ \n]*?ld[^:\n]*?: [^\n]*?section `\.text' will not fit in region `v1'\n[^ \n]*?ld[^:\n]*?: region `v1' overflowed by 16 bytes\Z
>  
>  #...
> diff --git a/ld/testsuite/ld-scripts/rgn-over6.d b/ld/testsuite/ld-scripts/rgn-over6.d
> index 66c5a16216b..b8731ad216f 100644
> --- a/ld/testsuite/ld-scripts/rgn-over6.d
> +++ b/ld/testsuite/ld-scripts/rgn-over6.d
> @@ -1,6 +1,6 @@
>  # name: rgn-over6
>  # source: rgn-over.s
> -# ld: -T rgn-over6.t -Map tmpdir/rgn-over6.map
> +# ld: -T rgn-over6.t -Map tmpdir/rgn-over6.map --no-error-rwx-segments
>  # error: \A[^ \n]*?ld[^:\n]*?: [^\n]*?section `\.text' will not fit in region `r1'\n[^ \n]*?ld[^:\n]*?: [^\n]*?section `\.text' will not fit in region `v1'\n[^ \n]*?ld[^:\n]*?: region `r1' overflowed by 16 bytes\n[^ \n]*?ld[^:\n]*?: region `v1' overflowed by 16 bytes\Z
>  
>  #...
> diff --git a/ld/testsuite/ld-scripts/script.exp b/ld/testsuite/ld-scripts/script.exp
> index 28cc6daf51d..2f88cabca0a 100644
> --- a/ld/testsuite/ld-scripts/script.exp
> +++ b/ld/testsuite/ld-scripts/script.exp
> @@ -190,7 +190,7 @@ if { [is_pecoff_format] } then {
>  }
>  set flags $LDFLAGS
>  
> -if ![ld_link $ld tmpdir/script "$flags -T $srcdir/$subdir/script.t tmpdir/script.o"] {
> +if ![ld_link $ld tmpdir/script "$flags -T $srcdir/$subdir/script.t tmpdir/script.o --no-error-rwx-segments"] {
>      fail $testname
>  } else {
>      check_script
> @@ -198,7 +198,7 @@ if ![ld_link $ld tmpdir/script "$flags -T $srcdir/$subdir/script.t tmpdir/script
>  
>  set testname "MRI script"
>  
> -if ![ld_link $ld tmpdir/script "$flags -c $srcdir/$subdir/scriptm.t"] {
> +if ![ld_link $ld tmpdir/script "$flags -c $srcdir/$subdir/scriptm.t --no-error-rwx-segments"] {
>      fail $testname
>  } else {
>      check_script
> diff --git a/ld/testsuite/ld-scripts/sizeof.exp b/ld/testsuite/ld-scripts/sizeof.exp
> index 389fde969d7..79a1130e0f3 100644
> --- a/ld/testsuite/ld-scripts/sizeof.exp
> +++ b/ld/testsuite/ld-scripts/sizeof.exp
> @@ -34,7 +34,7 @@ if { [is_pecoff_format] } {
>  }
>  
>  if ![ld_link $ld tmpdir/sizeof "$LDFLAGS -T $srcdir/$subdir/sizeof.t \
> -	$IMAGE_BASE tmpdir/sizeof.o"] {
> +	$IMAGE_BASE tmpdir/sizeof.o --no-error-rwx-segments"] {
>      fail $testname
>      return
>  }
> diff --git a/ld/testsuite/ld-scripts/sort-file.d b/ld/testsuite/ld-scripts/sort-file.d
> index 01eb694c63f..8d395ac6489 100644
> --- a/ld/testsuite/ld-scripts/sort-file.d
> +++ b/ld/testsuite/ld-scripts/sort-file.d
> @@ -1,6 +1,6 @@
>  #source: sort-file2.s
>  #source: sort-file1.s
> -#ld: -T sort-file.t
> +#ld: -T sort-file.t --no-error-rwx-segments
>  #nm: -n
>  
>  # Check that SORT_BY_NAME on filenames works
> diff --git a/ld/testsuite/ld-x86-64/discarded1.d b/ld/testsuite/ld-x86-64/discarded1.d
> index c8925956280..e6b2bca083b 100644
> --- a/ld/testsuite/ld-x86-64/discarded1.d
> +++ b/ld/testsuite/ld-x86-64/discarded1.d
> @@ -1,3 +1,3 @@
>  #as: --64
> -#ld: -melf_x86_64 -T discarded1.t
> +#ld: -melf_x86_64 -T discarded1.t --no-error-rwx-segments
>  #error: .*discarded output section: `.got.plt'
> diff --git a/ld/testsuite/ld-x86-64/pr19175.d b/ld/testsuite/ld-x86-64/pr19175.d
> index 70e56892130..171ebd440d1 100644
> --- a/ld/testsuite/ld-x86-64/pr19175.d
> +++ b/ld/testsuite/ld-x86-64/pr19175.d
> @@ -1,6 +1,6 @@
>  #source: pr19175.s
>  #as: --64
> -#ld: -Bsymbolic -shared -melf_x86_64 -T pr19175.t
> +#ld: -Bsymbolic -shared -melf_x86_64 -T pr19175.t --no-error-rwx-segments
>  #objdump: -dw
>  
>  .*: +file format .*
> diff --git a/ld/testsuite/ld-x86-64/pr19539a.d b/ld/testsuite/ld-x86-64/pr19539a.d
> index 3b696c58cb6..91393b944b4 100644
> --- a/ld/testsuite/ld-x86-64/pr19539a.d
> +++ b/ld/testsuite/ld-x86-64/pr19539a.d
> @@ -1,6 +1,6 @@
>  #source: pr19539.s
>  #as: --64
> -#ld: -pie -m elf_x86_64 -T pr19539.t -z notext
> +#ld: -pie -m elf_x86_64 -T pr19539.t -z notext --no-error-rwx-segments
>  #readelf: -r --wide
>  
>  Relocation section '.rela.dyn' at offset 0x[0-9a-f]+ contains 1 entry:
> diff --git a/ld/testsuite/ld-x86-64/pr19539b.d b/ld/testsuite/ld-x86-64/pr19539b.d
> index 0e50f326466..b15e8e4c022 100644
> --- a/ld/testsuite/ld-x86-64/pr19539b.d
> +++ b/ld/testsuite/ld-x86-64/pr19539b.d
> @@ -1,6 +1,6 @@
>  #source: pr19539.s
>  #as: --x32
> -#ld: -pie -m elf32_x86_64 -T pr19539.t -z notext
> +#ld: -pie -m elf32_x86_64 -T pr19539.t -z notext --no-error-rwx-segments
>  #readelf: -r --wide
>  
>  Relocation section '.rela.dyn' at offset 0x[0-9a-f]+ contains 1 entry:
> diff --git a/ld/testsuite/ld-x86-64/pr23189.d b/ld/testsuite/ld-x86-64/pr23189.d
> index 6fc4b7ee2c3..a22d3e26854 100644
> --- a/ld/testsuite/ld-x86-64/pr23189.d
> +++ b/ld/testsuite/ld-x86-64/pr23189.d
> @@ -1,5 +1,5 @@
>  #as: --64  -mrelax-relocations=yes
> -#ld: -shared -melf_x86_64 -T pr23189.t
> +#ld: -shared -melf_x86_64 -T pr23189.t --no-error-rwx-segments
>  #readelf: -r --wide
>  
>  There are no relocations in this file.
  

On 18.10.2023 12:57, Sam James wrote:
> Nick Clifton <nickc@redhat.com> writes:
> 
>> Hi Guys,
>>
>>   I am working on a patch to turn the linker's warning messages about
>>   executable stacks into errors.  My intent is to use this to force
>>   programs that currently do have an executable stack to either change
>>   or deliberately disable the errors from the linker.  The plan is to
>>   then use this feature to help improve the security of Fedora
>>   binaries.
> 
> Thanks for working on this, Nick. We've had our own QA warnings in
> Gentoo for a long time with scanelf from pax-utils and there's few
> packages remaining with any sort of issue like this - and those which
> remain are usually a JIT or similar and just need to opt-in (in fact,
> they might already be doing so - our check doesn't look for that, we
> have a custom mechanism to silence FPs, so..).
> 
> Making textrels an error by default has gone well for us as well
> (pretty small fallout given we were warning on it for a while
> downstream:
> https://bugs.gentoo.org/showdependencytree.cgi?id=911581&hide_resolved=0),
> so might be worth coming back to that soon.
> 
>>
>>   I realise that the --fatal-warnings option could basically do the same
>>   thing, but that might be problematic for builds where some linker
>>   warnings are inevitable and can be safely ignored.  Hence I decided on
>>   a new command line option instead.
>>   
>>   The patch currently has these features:
>>
>>   * The change is configurable, but not on by default.
> 
> I think this part is up to you but it's easier if it's on by default for
> two reasons:
> 1) It's confusing if some distributions decide to turn it on and some
> don't (and it makes life easier for distributions if upstreams are more
> likely to be building with a version which has it on - both for bug
> reports & having this stuff get fixed);

I'm actually in favor of it being default-off. I'm building a number of
older versions of OS-kernel-like things, and having to patch them more
than absolutely necessary is undesirable (despite linking being quite
verbose due to the warnings, I've avoided such patching till now).
Nevertheless I could of course cope, if need be (and the same would
likely apply to others who find themselves in a similar position).

Jan
  

Hi Jan, Hi Sam,

>>>    * The change is configurable, but not on by default.
>>
>> I think this part is up to you but it's easier if it's on by default for
>> two reasons:

> I'm actually in favor of it being default-off. I'm building a number of
> older versions of OS-kernel-like things, 

What I think would be best would be to default to feature-off for now.
Once it has been in for a release or two, and distributions like Gentoo
and Suse and Fedora have had a chance to use it and audit their code
bases, then it would make sense to change the default to "feature-on".

Cheers
   Nick