Bug#1113774: Disabling -fcf-protection in sudo for bookworm

On Tue, Sep 02, 2025 at 05:46:27PM +0200, Andrea Pappacoda wrote:
>I personally find the argument of whether Marcos' CPU is supported not 
>really persuasive, since, if I got this correct, that compiler option 
>is doing nothing good and just causing issues to a subset of our 
>users.

I think that this is what the entire thing boils down. I am unwilling to 
disable that compiler option if there is a feather of a possibility that 
doing so would decrease security for systems that do support the opcode 
in question.

If we (that means Debian, the TC or some other part that I have trust 
in) come to the consensus that it all our release architectures are well 
served with full security even if -fcf-protection is just set for 
x86_64, I am fine with doing that changes and providing an appropriately 
patched version for bookworm (and trixie).

I am not close enough to this level of systems programming to have my 
own informed knowledge about this matter, but I need that advice coming 
from a body that I trust.

We had the OpenSSL random generator desaster from 2008 originating from 
not well given upstream advice, and I don't want to repeat this.

Greetings
Marc