怎样检查 SO 的可写可执行段和可执行栈风险

#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
  printf '%s\n' 'usage: audit-elf-segments REPORT' >&2
  exit 2
fi
report=$1
if [ ! -r "$report" ]; then
  printf '%s\n' 'report is not readable' >&2
  exit 2
fi
if [ ! -s "$report" ]; then
  printf '%s\n' 'report is empty' >&2
  exit 2
fi
awk '
BEGIN { load_count = 0; stack_count = 0; violations = 0 }
/^[[:space:]]*LOAD[[:space:]]/ {
  load_count++
  flags = $0
  sub(/^[[:space:]]*LOAD[[:space:]]+/, "", flags)
  if (flags ~ /W/ && flags ~ /E/) {
    printf "W+X LOAD: %s\n", $0 > "/dev/stderr"
    violations++
  }
}
/^[[:space:]]*GNU_STACK[[:space:]]/ {
  stack_count++
  flags = $0
  sub(/^[[:space:]]*GNU_STACK[[:space:]]+/, "", flags)
  if (flags ~ /E/) {
    printf "executable GNU_STACK: %s\n", $0 > "/dev/stderr"
    violations++
  }
}
END {
  if (load_count == 0) {
    print "no LOAD segment found" > "/dev/stderr"
    exit 3
  }
  if (stack_count != 1) {
    print "GNU_STACK count is not one" > "/dev/stderr"
    exit 4
  }
  if (violations != 0) {
    exit 5
  }
}
' "$report"
printf '%s\n' 'ELF segment policy passed'