[release/8.0-staging] Disable W^X in Rosetta emulated x64 containers on macOS #105117
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
The docker on macOS Arm64 uses Rosetta to run x64 containers. That has an effect on the double mapping. The Rosetta is unable to detect when an already executed code page is modified. So we cannot use double mapping on those containers. To detect that case, this change adds check that verifies that the double mapping works even when the code is modified. Close #102226
This will help WINE running 32 bit code under rosetta emulation on macOS.
jeffschwMSFT
added
Servicing-approved
|
@janvorli @jeffschwMSFT I'm about to close the servicing branches. Should we get this merged to include it in the September release or do we want to wait until October? |
|
unless sent in email and approved tonight, it will be for the next release |
Oh, I was asking because it had the @janvorli can you please send an email to Tactics requesting approval? |
carlossanlop
added
Servicing-consider
|
apologies I got the issues mixed up, this was approved in tactics last week. switching labels back |
jeffschwMSFT
added
Servicing-approved
@jeffschwMSFT so do we want to get it included in the September Release? I can just cherry-pick this change. Asking because I already flowed everything from staging to internal: #106301 |
|
if possible, yes. it was my mistake on not getting it merged earlier |
|
/backport to release/8.0 |
|
Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/10374534934 |
Backport of #102509 to release/8.0-staging
/cc @janvorli
Customer Impact
The docker on macOS Arm64 uses Rosetta to run x64 containers. That has an effect on the double mapping. The Rosetta is unable to detect when an already executed code page is modified. So we cannot use double mapping on those containers. To detect that case, this change adds check that verifies that the double mapping works even when the code is modified.
Regression
Testing
The fix was verified locally on macOS using docker. The issue was not seen before because we don't test Linux x64 containers on arm64 macOS.
Risk
Low, this fix was in main for two months without causing any problems.