Is the ELF .notes section really needed?

Question

On Linux, I'm trying to strip a statically linked ELF file to the bare essentials. When I run:

strip --strip-unneeded foo

or

strip --strip-all foo

The resulting file still has a fat .notes section that appears to be full of funky strings.

Is the .notes section really needed or can I safely force it out with --remove-section?

Thanks for any help.

Answer 1

From experience and from looking at the man page for strip, it looks like strip isn't supposed to get rid of any and all sections and strings that aren't needed; just symbols. Quoth the man page:

   GNU strip discards all symbols from object files objfile.

That being said, from experience, strip, even without --strip-all, removes sections unneeded for loading, such as .symtab and .strtab, and you can, as you note, remove sections you want it with --remove-section.

As an example of a .notes section, I took /bin/ls from my Ubuntu 11.10 64-bit box:

$ readelf -Wn /bin/ls

Notes at offset 0x00000254 with length 0x00000020:
  Owner                 Data size   Description
  GNU                  0x00000010   NT_GNU_ABI_TAG (ABI version tag)
    OS: Linux, ABI: 2.6.15

Notes at offset 0x00000274 with length 0x00000024:
  Owner                 Data size   Description
  GNU                  0x00000014   NT_GNU_BUILD_ID (unique build ID bitstring)
    Build ID: 3e6f3159144281f709c3c5ffd41e376f53b47952

That encompasses the .note.ABI-tag section and the .note.gnu.build-id section. It looks like they contain data that isn't necessary to load the program, but also isn't standard, and isn't known by strip to not be necessary for the proper running of the program, since an ELF can have any number of additional "unknown" sections that aren't safe to remove. So rather using a virtual whitelist (which would fail miserably), it uses a blacklist of sections that it knows it can get rid of, and does so.

Short version: these sections don't seem to be standard and could be used for various things, so strip can't know it's safe to remove them. But based on the info inside the one I took above, if it's your own program, it's almost certainly safe to remove it.