title: Why is execstack required to execute code on the heap?
body: <p>I wrote the code below to test shellcode (for unlinking <code>/tmp/passwd</code>) for an assignment in a security class.</p>
  
  <p>When I compile with <code>gcc -o test -g test.c</code>, I get a segfault on the jump into the shellcode.</p>
  
  <p>When I postprocess the binary with <code>execstack -s test</code>, I no longer get a segfault and the shellcode executes correctly, removing <code>/tmp/passwd</code>.</p>
  
  <p>I am running <code>gcc 4.7.2</code>. It seems like it is bad idea to require the stack to be executable in order to make the heap executable, since there are many more legitimate use cases of the latter than the former.</p>
  
  <p><strong>Is this expected behavior? If so, what is the rationale?</strong> </p>
  
  <pre><code>#include &lt;stdio.h&gt;                                     
  #include &lt;stdlib.h&gt;                                    
  
  
  char* shellcode;                                       
  
  
  int main(){                                            
      shellcode = malloc(67);                            
      FILE* code = fopen("shellcode.bin", "rb");      
      fread(shellcode, 1, 67, code);                     
  
      int (*fp)(void) = (int (*) (void)) shellcode;      
      fp();                                              
  }    
  </code></pre>
  
  <p>Here is the output of <code>xxd shellcode.bin</code>:</p>
  
  <pre><code>0000000: eb28 5e89 760c 31c0 8846 0bfe c0fe c0fe  .(^.v.1..F......           
  0000010: c0fe c0fe c0fe c0fe c0fe c0fe c0fe c089  ................           
  0000020: f3cd 8031 db89 d840 cd80 e8d3 ffff ff2f  ...1...@......./           
  0000030: 746d 702f 7061 7373 7764                 tmp/passwd                 
  </code></pre>