| From | Florian Weimer <> | Subject | Re: [PATCH 34/35] x86/cet/shstk: Support wrss for userspace | Date | Mon, 31 Jan 2022 08:56:45 +0100 |
| |
* Rick Edgecombe:
> For the current shadow stack implementation, shadow stacks contents cannot > be arbitrarily provisioned with data. This property helps apps protect > themselves better, but also restricts any potential apps that may want to > do exotic things at the expense of a little security. > > The x86 shadow stack feature introduces a new instruction, wrss, which > can be enabled to write directly to shadow stack permissioned memory from > userspace. Allow it to get enabled via the prctl interface.
Why can't this be turned on unconditionally?
Thanks, Florian
|