[PATCH v8 00/20] aarch64: Add support for Guarded Control Stack extension

[Yury Khrustalev]

On Thu, Jan 16, 2025 at 10:49:45AM -0300, Adhemerval Zanella Netto wrote:
> 
> Hi Yuri,
> 
> I think I reviewed all the remaning patches, and the only contention I have is
> the inclusion of aarch64_gcs_policy=1 that allows dlopen to disable GCS support
> if a shared library does not contain the GCS marking.

I think there is some misunderstanding here. If glibc.cpu.aarch64_gcs is set,
then dlopen() can never disable GCS. If policy is non-zero, it will be an error,
and if policy is 0, GCS will remain enabled.

> 
> As I said, we recently removed a similar support for executable stacks
> (commit 0ca8785a28) because this is silent change of process semantic and
> it also used as way to enable a RCE on a CVE [1].
> 
> So I don't think we should explict support options to allow process to move
> from a hardened to a lower hardened security perpective, specially in a
> silent manner, and even though a explicit option (the tunable, where use
> does need to opt-in).
> 
> It would be good to have some more input for other maintainers.  How x86 does
> in this regard (I haven't check it).
> 
> [1] https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt


Thanks,
Yury