[PATCH 1/2] aarch64: Lock GCS with glibc.cpu.aarch64_gcs_lock tunable

[Mark Brown]

On Fri, Dec 19, 2025 at 10:17:02AM -0300, Adhemerval Zanella Netto wrote:

> My view is although GNU_PROPERTY_AARCH64_FEATURE_1_GCS is a hint that depends
> of the underlying system supports; once it is applied by the dynamic loader
> a reasonable assumption that the program should *not* be able to disable it.

> The non-exec stack being able to be disabled during process execution was a
> mistake and a security hazard.  I do not think we should do something similar
> with GCS.

The current patch locks all shadow stack feature bits.  As well as the
basic GCS enable and any future controls this also includes the controls
for GCSSTR and GCSPUSHM, for those there's no current way for binaries
to indicate that they need them and if we lock all bits then there would
be no possibility for them to enable themselves.  It does seem like we
should have some interface for doing that, I don't have strong opinions
on what that would look like but I'd guess some more property bits might
be it.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20251219/86b9afd0/attachment.sig>