diff --git a/binutils-testsuite-fixes.patch b/binutils-testsuite-fixes.patch
index 6014415..71045a9 100644
--- a/binutils-testsuite-fixes.patch
+++ b/binutils-testsuite-fixes.patch
@@ -1125,3 +1125,39 @@ diff -rup binutils.orig/ld/testsuite/ld-elf/tls.exp binutils-2.40/ld/testsuite/l
  # Check to see if the C compiler works.
  if { ![check_compiler_available] } {
      return
+--- binutils.orig/binutils/testsuite/lib/binutils-common.exp	2023-06-21 09:46:50.861865196 +0100
++++ binutils-2.40/binutils/testsuite/lib/binutils-common.exp	2023-06-21 09:47:24.240856913 +0100
+@@ -641,6 +641,8 @@ proc prune_warnings_extra { text } {
+     regsub -all "(^|\n)(\[^\n\]*: NOTE: This behaviour is deprecated\[^\n\]*\n?)+" $text "\\1" text
+     regsub -all "(^|\n)(\[^\n\]*: warning:\[^\n\]*has a LOAD segment with RWX permissions\[^\n\]*\n?)+" $text "\\1" text
+     regsub -all "(^|\n)(\[^\n\]*: warning:\[^\n\]*has a TLS segment with execute permission\[^\n\]*\n?)+" $text "\\1" text
++     # Configuring with --enable-warn-execstack=yes will generate warnings if -z execstack is used.
++     regsub -all "(^|\n)(\[^\n\]*: warning: enabling an executable stack because of -z execstack command line option\[^\n\]*\n?)+" $text "\\1" text
+     return $text
+ }
+ 
+diff -rup binutils-2.40/ld/testsuite/ld-elf/elf.exp binutils.new/ld/testsuite/ld-elf/elf.exp
+--- binutils-2.40/ld/testsuite/ld-elf/elf.exp	2023-01-14 00:00:00.000000000 +0000
++++ binutils.new/ld/testsuite/ld-elf/elf.exp	2023-06-21 09:31:08.856233444 +0100
+@@ -180,6 +180,21 @@ if { [check_gc_sections_available] && ![
+ }
+ 
+ proc target_defaults_to_execstack {} {
++    global base_dir
++
++    # If the linker has been configured with --enable-default-execstack=no then
++    # this proc should always return 0.
++    if { [file exists $base_dir/config.status] } {
++	set status [remote_exec host grep "enable-default-execstack=no" $base_dir/config.status]
++	if { [lindex $status 0] == 0 } {
++	    return 0
++	} else {
++	    verbose -log "$base_dir/config.status does not contain enable-default-execstack=no"
++	}
++    } else {
++	verbose -log "there is no file $base_dir/config.status"
++    }
++    
+     if {   [istarget "aarch64*-*-*"]
+ 	|| [istarget "arc*-*-*"]
+ 	|| [istarget "cris*-*-*"]
diff --git a/binutils.spec b/binutils.spec
index 7db7202..7bed59e 100644
--- a/binutils.spec
+++ b/binutils.spec
@@ -2,7 +2,7 @@
 Summary: A GNU collection of binary utilities
 Name: binutils%{?_with_debug:-debug}
 Version: 2.40
-Release: 9%{?dist}
+Release: 10%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -31,6 +31,12 @@ URL: https://sourceware.org/binutils
 # Default is off because of BZ 1195883.
 %define enable_deterministic_archives 0
 
+# Generate a warning when linking creates an executable stack
+%define warn_for_executable_stacks 0
+
+# Generate a warning when linking creates a segment with read, write and execute permissions
+%define warn_for_rwx_segments 0
+
 # Enable support for GCC LTO compilation.
 # Disable if it is necessary to work around bugs in LTO.
 %define enable_lto 1
@@ -608,6 +614,19 @@ compute_global_configuration()
     CARGS="$CARGS --enable-deterministic-archives=no"
 %endif
 
+%if %{warn_for_executable_stacks}
+    CARGS="$CARGS --enable-warn-execstack=yes"
+    CARGS="$CARGS --enable-default-execstack=no"
+%else
+    CARGS="$CARGS --enable-warn-execstack=no"
+%endif
+
+%if %{warn_for_rwx_segments}
+    CARGS="$CARGS --enable-warn-rwx-segments=yes"
+%else
+    CARGS="$CARGS --enable-warn-rwx-segments=no"
+%endif
+
 %if %{enable_lto}
     CARGS="$CARGS --enable-lto"
 %endif
@@ -1085,17 +1104,20 @@ export QA_RPATHS=0x0003
 
 #----------------------------------------------------------------------------
 
+%if %{with gold}
+%post gold
+
+%{_sbindir}/alternatives --install %{_bindir}/ld ld \
+  %{_bindir}/ld.gold %{ld_gold_priority}
+exit 0
+%endif
+
 %post
 
 %__rm -f %{_bindir}/ld
 %{_sbindir}/alternatives --install %{_bindir}/ld ld \
   %{_bindir}/ld.bfd %{ld_bfd_priority}
 
-%if %{with gold}
-%{_sbindir}/alternatives --install %{_bindir}/ld ld \
-  %{_bindir}/ld.gold %{ld_gold_priority}
-%endif
-
 # Do not run "alternatives --auto ld" here.  Leave the setting to
 # however the user previously had it set.  See BZ 1592069 for more details.
 
@@ -1105,15 +1127,22 @@ exit 0
 
 #----------------------------------------------------------------------------
 
+# Note: $1 == 0 means that there is an uninstall in progress.
+# $1 == 1 means that there is an upgrade in progress.
+
+%if %{with gold}
+%preun gold
+
+if [ $1 = 0 ]; then
+  %{_sbindir}/alternatives --remove ld %{_bindir}/ld.gold
+fi
+exit 0
+%endif
+
 %preun
 if [ $1 = 0 ]; then
   %{_sbindir}/alternatives --remove ld %{_bindir}/ld.bfd
 fi
-%if %{with gold}
-if [ $1 = 0 ]; then
-  %{_sbindir}/alternatives --remove ld %{_bindir}/ld.gold
-fi
-%endif
 
 exit 0
 
@@ -1245,6 +1274,9 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
+* Wed Jun 21 2023 Nick Clifton  <nickc@redhat.com> - 2.40-10
+- Spec File: Add defines to enable rwx and execstack warnings.
+
 * Wed May 31 2023 Nick Clifton  <nickc@redhat.com> - 2.40-9
 - Spec File: Remove debug files from default package.  (#2208360)