lkml.org 
[lkml]   [2020]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v14 01/26] Documentation/x86: Add CET description
From
Date
On 11/6/2020 9:34 AM, Borislav Petkov wrote:
> On Mon, Oct 12, 2020 at 08:38:25AM -0700, Yu-cheng Yu wrote:
>> +[1] Overview
>> +============
>> +
>> +Control-flow Enforcement Technology (CET) is an Intel processor feature
>> +that provides protection against return/jump-oriented programming (ROP)
>> +attacks. It can be set up to protect both applications and the kernel.
>> +Only user-mode protection is implemented in the 64-bit kernel, including
>> +support for running legacy 32-bit applications.
>> +
>> +CET introduces Shadow Stack and Indirect Branch Tracking. Shadow stack is
>> +a secondary stack allocated from memory and cannot be directly modified by
>> +applications. When executing a CALL, the processor pushes the return
> ^
> . .. instruction ...
>

I will update it.

[...]

>> +
>> +[2] Application Enabling
>> +========================
>> +
>> +An application's CET capability is marked in its ELF header and can be
>> +verified from the following command output, in the NT_GNU_PROPERTY_TYPE_0
>> +field:
>> +
>> + readelf -n <application>
>
> Can be verified how? What does it say for a CET-enabled executable? Put
> it here in the doc pls.
>

readelf -n <application> | grep SHSTK
properties: x86 feature: IBT, SHSTK

I will add this.

[...]

>> +[3] Backward Compatibility
>> +==========================
>> +
>> +GLIBC provides a few tunables for backward compatibility.
>> +
>> +GLIBC_TUNABLES=glibc.tune.hwcaps=-SHSTK,-IBT
>> + Turn off SHSTK/IBT for the current shell.
>
> For the current shell? How?
>
> You mean, you execute the kernel shell with that variable set? So you
> set this variable in any executable's env which links with glibc in
> order to disable CET?
>
> In any case, this needs clarification.
>

In the current shell, if GLIBC_TUNABLES variable is set as such,
applications started will have CET features disabled. I can put more
details here, or maybe a reference to the GLIBC man pages.

Thanks,
Yu-cheng

\
 
 \ /
  Last update: 2020-11-06 19:17    [W:0.089 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site