Re: [PATCH v14 01/26] Documentation/x86: Add CET description

[Borislav Petkov]

On Mon, Oct 12, 2020 at 08:38:25AM -0700, Yu-cheng Yu wrote:
> +[1] Overview
> +============
> +
> +Control-flow Enforcement Technology (CET) is an Intel processor feature
> +that provides protection against return/jump-oriented programming (ROP)
> +attacks.  It can be set up to protect both applications and the kernel.
> +Only user-mode protection is implemented in the 64-bit kernel, including
> +support for running legacy 32-bit applications.
> +
> +CET introduces Shadow Stack and Indirect Branch Tracking.  Shadow stack is
> +a secondary stack allocated from memory and cannot be directly modified by
> +applications.  When executing a CALL, the processor pushes the return
				       ^
				    . .. instruction ...


> +address to both the normal stack and the shadow stack.  Upon function
> +return, the processor pops the shadow stack copy and compares it to the
> +normal stack copy.  If the two differ, the processor raises a control-
> +protection fault.  Indirect branch tracking verifies indirect CALL/JMP
> +targets are intended as marked by the compiler with 'ENDBR' opcodes.
> +
> +There are two kernel configuration options:
> +
> +    X86_SHADOW_STACK_USER, and
> +    X86_BRANCH_TRACKING_USER.
> +
> +These need to be enabled to build a CET-enabled kernel, and Binutils v2.31
> +and GCC v8.1 or later are required to build a CET kernel.  To build a CET-
> +enabled application, GLIBC v2.28 or later is also required.
> +
> +There are two command-line options for disabling CET features::
> +
> +    no_user_shstk - disables user shadow stack, and
> +    no_user_ibt   - disables user indirect branch tracking.
> +
> +At run time, /proc/cpuinfo shows CET features if the processor supports
> +CET.
> +
> +[2] Application Enabling
> +========================
> +
> +An application's CET capability is marked in its ELF header and can be
> +verified from the following command output, in the NT_GNU_PROPERTY_TYPE_0
> +field:
> +
> +    readelf -n <application>

Can be verified how? What does it say for a CET-enabled executable? Put
it here in the doc pls.

> +
> +If an application supports CET and is statically linked, it will run with
> +CET protection.  If the application needs any shared libraries, the loader
> +checks all dependencies and enables CET when all requirements are met.
> +
> +[3] Backward Compatibility
> +==========================
> +
> +GLIBC provides a few tunables for backward compatibility.
> +
> +GLIBC_TUNABLES=glibc.tune.hwcaps=-SHSTK,-IBT
> +    Turn off SHSTK/IBT for the current shell.

For the current shell? How?

You mean, you execute the kernel shell with that variable set? So you
set this variable in any executable's env which links with glibc in
order to disable CET?

In any case, this needs clarification.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette