Bug 1175154 - Add Control-flow Enforcement Technology (CET) to openSUSE
Summary: Add Control-flow Enforcement Technology (CET) to openSUSE
Status: NEW
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Basesystem (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Enhancement (vote)
Target Milestone: ---
Assignee: Richard Biener
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-08-12 11:49 UTC by Libor Pechacek
Modified: 2023-12-04 12:20 UTC (History)
7 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Libor Pechacek 2020-08-12 11:49:40 UTC 
Control-flow Enforcement Technology (CET) looks like a promising mitigation of Return Oriented Programming group of attacks. CET requires support in the CPU (starting with Intel Tiger Lake, if I'm not mistaken), kernel support, and support in the libraries and the application code itself.

According to the technology partner, this capability needs enabling:
*    Kernel
*    KVM
*    QEMU
*    Tool Chain GCC v8.1
*    GDB Support – TBD
*    GNU Binutils v2.31
*    GLIBC v2.28
Comment 1 Marcus Meissner 2020-08-12 13:52:17 UTC 
I opened https://jira.suse.com/browse/PM-2110 already a week ago.
Comment 2 Richard Biener 2020-08-24 11:01:28 UTC 
On x86_64 the compiler side is enabled now (including CET enabled runtime libraries).  Build-wise the main missing piece is enabling this through
RPM_OPT_FLAGS unless we want to be more selective.

Not sure why the bug is assigned to me.
Comment 3 Marcus Meissner 2020-09-07 13:02:24 UTC 
I started a confluence page for coordination.

https://confluence.suse.com/pages/viewpage.action?pageId=569311509


Johannes would like to drive this to factory.
Comment 4 OBSbugzilla Bot 2020-10-28 11:20:07 UTC 
This is an autogenerated message for OBS integration:
This bug (1175154) was mentioned in
https://build.opensuse.org/request/show/844528 Factory / glibc