On Wed, Jun 26, 2019 at 10:14:07AM -0700, Andy Lutomirski wrote: > On Thu, May 2, 2019 at 4:10 AM Dave Martin <Dave.Martin@xxxxxxx> wrote: [...] > > A couple of questions before I look in more detail: > > > > 1) Can we rely on PT_GNU_PROPERTY being present in the phdrs to describe > > the NT_GNU_PROPERTY_TYPE_0 note? If so, we can avoid trying to parse > > irrelevant PT_NOTE segments. > > > > > > 2) Are there standard types for things like the program property header? > > If not, can we add something in elf.h? We should try to coordinate with > > libc on that. Something like > > > > Where did PT_GNU_PROPERTY come from? Are there actual docs for it? > Can someone here tell us what the actual semantics of this new ELF > thingy are? From some searching, it seems like it's kind of an ELF > note but kind of not. An actual description would be fantastic. https://github.com/hjl-tools/linux-abi/wiki/linux-abi-draft.pdf I don't know _when_ it was added, and the description is minimal, but it's there. (I'd say it's fairly obvious how it should be used, but it could do with some clarification...) > Also, I don't think there's any actual requirement that the upstream > kernel recognize existing CET-enabled RHEL 8 binaries as being > CET-enabled. I tend to think that RHEL 8 jumped the gun here. While > the upstream kernel should make some reasonble effort to make sure > that RHEL 8 binaries will continue to run, I don't see why we need to > go out of our way to keep the full set of mitigations available for > binaries that were developed against a non-upstream kernel. If that's an accpetable approach, it should certainly make our life easier. > In fact, if we handle the legacy bitmap differently from RHEL 8, we > may *have* to make sure that we don't recognize existing RHEL 8 > binaries as CET-enabled. Can't comment on that. If the existing RHEL 8 binaries strictly don't have the PT_GNU_PROPERTY phdr, then this might serve a dual purpose ... otherwise, x86 might need some additional annotation for new binaries. I'll leave it for others to comment. Cheers ---Dave
