diff options
| author | H.J. Lu <hjl.tools@gmail.com> | 2020-04-27 15:44:07 -0700 |
|---|---|---|
| committer | H.J. Lu <hjl.tools@gmail.com> | 2020-05-18 08:38:53 -0700 |
| commit | 9e38f455a6c602be86b7b5a8d6523cbdcd7ec051 (patch) | |
| tree | 3fa62a570dd9ae651db62b21231a63358bd66edf /INSTALL | |
| parent | ce12fc711387375d0248ab3ff9084fb958c43bc6 (diff) | |
| download | glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.gz glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.xz glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.zip | |
x86: Add --enable-cet=permissive
When CET is enabled, it is an error to dlopen a non CET enabled shared library in CET enabled application. It may be desirable to make CET permissive, that is disable CET when dlopening a non CET enabled shared library. With the new --enable-cet=permissive configure option, CET is disabled when dlopening a non CET enabled shared library. Add DEFAULT_DL_X86_CET_CONTROL to config.h.in: /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_elf_property which enables CET features based on ELF property note. --enable-cet=permissive it to /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_permissive which enables CET features permissively. Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive.
Diffstat (limited to 'INSTALL')
| -rw-r--r-- | INSTALL | 26 |
1 files changed, 15 insertions, 11 deletions
diff --git a/INSTALL b/INSTALL index b7676d1c9f..62e78725f5 100644 --- a/INSTALL +++ b/INSTALL @@ -123,20 +123,24 @@ if 'CFLAGS' is specified it must enable optimization. For example: executables (PIE) by default. '--enable-cet' +'--enable-cet=permissive' Enable Intel Control-flow Enforcement Technology (CET) support. - When the GNU C Library is built with '--enable-cet', the resulting - library is protected with indirect branch tracking (IBT) and shadow - stack (SHSTK). When CET is enabled, the GNU C Library is - compatible with all existing executables and shared libraries. - This feature is currently supported on i386, x86_64 and x32 with - GCC 8 and binutils 2.29 or later. Note that when CET is enabled, - the GNU C Library requires CPUs capable of multi-byte NOPs, like - x86-64 processors as well as Intel Pentium Pro or newer. + When the GNU C Library is built with '--enable-cet' or + '--enable-cet=permissive', the resulting library is protected with + indirect branch tracking (IBT) and shadow stack (SHSTK). When CET + is enabled, the GNU C Library is compatible with all existing + executables and shared libraries. This feature is currently + supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or + later. Note that when CET is enabled, the GNU C Library requires + CPUs capable of multi-byte NOPs, like x86-64 processors as well as + Intel Pentium Pro or newer. With '--enable-cet', it is an error to + dlopen a non CET enabled shared library in CET enabled application. + With '--enable-cet=permissive', CET is disabled when dlopening a + non CET enabled shared library in CET enabled application. NOTE: '--enable-cet' has been tested for i686, x86_64 and x32 on - non-CET processors. '--enable-cet' has been tested for x86_64 and - x32 on CET SDVs, but Intel CET support hasn't been validated for - i686. + non-CET processors. '--enable-cet' has been tested for i686, + x86_64 and x32 on CET processors. '--disable-profile' Don't build libraries with profiling information. You may want to |