From Fedora Project Wiki


Enable Shadow Stack Userspace Support on x86_64

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

Enable support for shadow stacks in userspace by using the Linux kernel API that will be made available in 6.4.

Owner


Current status

  • Targeted release: Fedora Linux 39
  • Last updated: 2023-05-08
  • FESCo issue: <will be assigned by the Wrangler>
  • Tracker bug: <will be assigned by the Wrangler>
  • Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

Much of the distribution is already built with Intel CET extensions using the -fcf-protection flag. This change mainly does the following:

  • Enable userspace support in glibc to utilize the Linux kernel API and enable shadow stacks for userspace
  • Add macros in redhat-rpm-config to allow broken packages to override CET build flags to allow them to continue running.

Feedback

Benefit to Fedora

Enabling shadow stack has the primary advantage of security improvement, allowing...

Scope

  • Proposal owners:
  • Other developers:
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Community Initiatives:

Upgrade/compatibility impact

How To Test

User Experience

Dependencies

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No


Documentation

N/A (not a System Wide Change)

Release Notes