Changes/Enable Shadow Stack Userspace Support

Enable Shadow Stack Userspace Support on x86_64

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

Enable support for shadow stacks in userspace by using the Linux kernel API that will be made available in 6.4.

Owner

• Name: Siddhesh Poyarekar
• Email: sipoyare@redhat.com

Current status

• Targeted release: Fedora Linux 39
• Last updated: 2023-05-08
• FESCo issue: <will be assigned by the Wrangler>
• Tracker bug: <will be assigned by the Wrangler>
• Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

Much of the distribution is already built with Intel CET extensions using the -fcf-protection flag. This change mainly does the following:

• Enable userspace support in glibc to utilize the Linux kernel API and enable shadow stacks for userspace
• Add macros in redhat-rpm-config to allow broken packages to override CET build flags to allow them to continue running.

Benefit to Fedora

Enabling shadow stack has the primary advantage of security improvement, allowing...

Scope

• Proposal owners:

• Other developers:

• Release engineering: #Releng issue number

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A (not needed for this Change)

• Alignment with Community Initiatives:

Contingency Plan

• Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
• Contingency deadline: N/A (not a System Wide Change)
• Blocks release? N/A (not a System Wide Change), Yes/No

Documentation

N/A (not a System Wide Change)