Messages in this thread | | | Date | Tue, 08 Feb 2022 21:18:44 -0800 | From | Joao Moreira <> | Subject | Re: [RFC][PATCH 6/6] objtool: Add IBT validation / fixups |
| |
> Ah, excellent, thanks for the pointers. There's also this in the works: > https://reviews.llvm.org/D119296 (a new CFI mode, designed to play nice > to objtool, IBT, etc.)
Oh, great! Thanks for pointing it out. I guess I saw something with a similar name before ;) https://www.blackhat.com/docs/asia-17/materials/asia-17-Moreira-Drop-The-Rop-Fine-Grained-Control-Flow-Integrity-For-The-Linux-Kernel.pdf
Jokes aside (and perhaps questions more targeted to Sami), from a diagonal look it seems that this follows the good old tag approach proposed by PaX/grsecurity, right? If this is the case, should I assume it could also benefit from features like -mibt-seal? Also are you considering that perhaps we can use alternatives to flip different CFI instrumentation as suggested by PeterZ in another thread?
Tks, Joao
| |