* Rick Edgecombe: > For the current shadow stack implementation, shadow stacks contents cannot > be arbitrarily provisioned with data. This property helps apps protect > themselves better, but also restricts any potential apps that may want to > do exotic things at the expense of a little security. > > The x86 shadow stack feature introduces a new instruction, wrss, which > can be enabled to write directly to shadow stack permissioned memory from > userspace. Allow it to get enabled via the prctl interface. Why can't this be turned on unconditionally? Thanks, Florian
