about summary refs log tree commit diff
path: root/manual
diff options
context:
space:
mode:
authorH.J. Lu <hjl.tools@gmail.com>2020-04-27 15:44:07 -0700
committerH.J. Lu <hjl.tools@gmail.com>2020-05-18 08:38:53 -0700
commit9e38f455a6c602be86b7b5a8d6523cbdcd7ec051 (patch)
tree3fa62a570dd9ae651db62b21231a63358bd66edf /manual
parentce12fc711387375d0248ab3ff9084fb958c43bc6 (diff)
downloadglibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.gz
glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.xz
glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.zip
x86: Add --enable-cet=permissive
When CET is enabled, it is an error to dlopen a non CET enabled shared
library in CET enabled application.  It may be desirable to make CET
permissive, that is disable CET when dlopening a non CET enabled shared
library.  With the new --enable-cet=permissive configure option, CET is
disabled when dlopening a non CET enabled shared library.

Add DEFAULT_DL_X86_CET_CONTROL to config.h.in:

 /* The default value of x86 CET control.  */
 #define DEFAULT_DL_X86_CET_CONTROL cet_elf_property

which enables CET features based on ELF property note.

--enable-cet=permissive it to

 /* The default value of x86 CET control.  */
 #define DEFAULT_DL_X86_CET_CONTROL cet_permissive

which enables CET features permissively.

Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and
tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive.
Diffstat (limited to 'manual')
-rw-r--r--manual/install.texi12
1 files changed, 8 insertions, 4 deletions
diff --git a/manual/install.texi b/manual/install.texi
index f6d9d92317..c1e49a94fe 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -152,20 +152,24 @@ PIE.  This option also implies that glibc programs and tests are created
 as dynamic position independent executables (PIE) by default.
 
 @item --enable-cet
+@itemx --enable-cet=permissive
 Enable Intel Control-flow Enforcement Technology (CET) support.  When
-@theglibc{} is built with @option{--enable-cet}, the resulting library
+@theglibc{} is built with @option{--enable-cet} or
+@option{--enable-cet=permissive}, the resulting library
 is protected with indirect branch tracking (IBT) and shadow stack
 (SHSTK)@.  When CET is enabled, @theglibc{} is compatible with all
 existing executables and shared libraries.  This feature is currently
 supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later.
 Note that when CET is enabled, @theglibc{} requires CPUs capable of
 multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or
-newer.
+newer.  With @option{--enable-cet}, it is an error to dlopen a non CET
+enabled shared library in CET enabled application.  With
+@option{--enable-cet=permissive}, CET is disabled when dlopening a
+non CET enabled shared library in CET enabled application.
 
 NOTE: @option{--enable-cet} has been tested for i686, x86_64 and x32
 on non-CET processors.  @option{--enable-cet} has been tested for
-x86_64 and x32 on CET SDVs, but Intel CET support hasn't been validated
-for i686.
+i686, x86_64 and x32 on CET processors.
 
 @item --disable-profile
 Don't build libraries with profiling information.  You may want to use