diff options
| author | H.J. Lu <hjl.tools@gmail.com> | 2020-04-27 15:44:07 -0700 |
|---|---|---|
| committer | H.J. Lu <hjl.tools@gmail.com> | 2020-05-18 08:38:53 -0700 |
| commit | 9e38f455a6c602be86b7b5a8d6523cbdcd7ec051 (patch) | |
| tree | 3fa62a570dd9ae651db62b21231a63358bd66edf /manual | |
| parent | ce12fc711387375d0248ab3ff9084fb958c43bc6 (diff) | |
| download | glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.gz glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.xz glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.zip | |
x86: Add --enable-cet=permissive
When CET is enabled, it is an error to dlopen a non CET enabled shared library in CET enabled application. It may be desirable to make CET permissive, that is disable CET when dlopening a non CET enabled shared library. With the new --enable-cet=permissive configure option, CET is disabled when dlopening a non CET enabled shared library. Add DEFAULT_DL_X86_CET_CONTROL to config.h.in: /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_elf_property which enables CET features based on ELF property note. --enable-cet=permissive it to /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_permissive which enables CET features permissively. Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive.
Diffstat (limited to 'manual')
| -rw-r--r-- | manual/install.texi | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/manual/install.texi b/manual/install.texi index f6d9d92317..c1e49a94fe 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -152,20 +152,24 @@ PIE. This option also implies that glibc programs and tests are created as dynamic position independent executables (PIE) by default. @item --enable-cet +@itemx --enable-cet=permissive Enable Intel Control-flow Enforcement Technology (CET) support. When -@theglibc{} is built with @option{--enable-cet}, the resulting library +@theglibc{} is built with @option{--enable-cet} or +@option{--enable-cet=permissive}, the resulting library is protected with indirect branch tracking (IBT) and shadow stack (SHSTK)@. When CET is enabled, @theglibc{} is compatible with all existing executables and shared libraries. This feature is currently supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later. Note that when CET is enabled, @theglibc{} requires CPUs capable of multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or -newer. +newer. With @option{--enable-cet}, it is an error to dlopen a non CET +enabled shared library in CET enabled application. With +@option{--enable-cet=permissive}, CET is disabled when dlopening a +non CET enabled shared library in CET enabled application. NOTE: @option{--enable-cet} has been tested for i686, x86_64 and x32 on non-CET processors. @option{--enable-cet} has been tested for -x86_64 and x32 on CET SDVs, but Intel CET support hasn't been validated -for i686. +i686, x86_64 and x32 on CET processors. @item --disable-profile Don't build libraries with profiling information. You may want to use |