Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 24 Aug 2020 17:32:35 -0700 | Subject | Re: [PATCH v11 9/9] x86: Disallow vsyscall emulation when CET is enabled |
| |
On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu <yu-cheng.yu@intel.com> wrote: > > From: "H.J. Lu" <hjl.tools@gmail.com> > > Emulation of the legacy vsyscall page is required by some programs built > before 2013. Newer programs after 2013 don't use it. Disallow vsyscall > emulation when Control-flow Enforcement (CET) is enabled to enhance > security.
NAK.
By all means disable execute emulation if CET-IBT is enabled at the time emulation is attempted, and maybe even disable the vsyscall page entirely if you can magically tell that CET-IBT will be enabled when a process starts, but you don't get to just disable it outright on a CET-enabled kernel.
| |