lkml.org 
[lkml]   [2023]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v7 28/41] x86: Introduce userspace API for shadow stack
Date
On Fri, 2023-03-10 at 12:00 -0800, H.J. Lu wrote:
> > > So it does:
> > > 1. Enable shadow stack
> > > 2. Call elf libs checking functions
> > > 3. If all good, lock shadow stack. Else, disable shadow stack.
> > > 4. Return from elf checking functions and if shstk is enabled,
> > > don't
> > > underflow because it was enabled in step 1 and we have return
> > > addresses
> > > from 2 on the shadow stack
> > >
> > > I'm wondering if this can't be improved in glibc to look like:
> > > 1. Check elf libs, and record it somewhere
> > > 2. Wait until just the right spot
> > > 3. If all good, enable and lock shadow stack.
> >
> > I will try it out.
> >
>
> Currently glibc enables shadow stack as early as possible. There
> are only a few places where a function call in glibc never returns.
> We can enable shadow stack just before calling main. There are
> quite some code paths without shadow stack protection. Is this
> an issue?

Thanks for checking. Hmm, does the loader get attacked?
\
 
 \ /
  Last update: 2023-03-27 00:53    [W:0.824 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site