=head1 NAME

B<fix-gnustack> - query or clear any ELF GNU_STACK executable flag

=head1 SYNOPSIS

B<fix-gnustack> -h

B<fix-gnustack> [-f] ELF

=head1 DESCRIPTION

B<fix-gnustack> scans the program headers of an ELF binary or shared
object library, reports if it has a GNU_STACK entry and if it is
marked both writeable and executable.  On PaX hardened kernels where
memory protection (MPROTECT) is enforced, execution of binaries with
GNU_STACKS marked WX, or execution of binaries linking against libraries
with GNU_STACKS marked WX, is terminated by the kernel.  When B<fix-gnustack>
is called without the B<-f> option on an ELF, it simply reports the
RWX (read/write/execute) flags on any GNU_STACK entry found.  When called
with B<-f>, it clears the X flag if a GNU_STACK entry is found and it
has both W and X flags.

=head1 OPTIONS

=over

=item B<-h>

Print out a short help message and exit.

=item [B<-f>] ELF

"Fix" the ELF, ie, remove the X flag from any GNU_STACK entry found
if it has both W and X flags.  When called without, it simply reports
what flags it found.

=back

=head1 HOMEPAGE

http://www.gentoo.org/proj/en/hardened/pax-quickstart.xml

=head1 REPORTING BUGS

Please report bugs at http://bugs.gentoo.org.

=head1 SEE ALSO

B<scanelf>(1), B<dumpelf>(1), B<paxctl>(1), B<paxctl-ng>(1), B<pspax>(1).

=head1 AUTHORS

B<Anthony G. Basile> <blueness@gentoo.org>
