Bug#1113774: Disabling -fcf-protection in sudo for bookworm

--MyHF+hSrGNiUZrWk
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Dec 05, 2025 at 12:38:59PM +0000, James Addison wrote:
>My reading of the thread is that fcf-protection=3Dreturn can be
>security-effective on 32-bit x86 processors, has no effect on binary
>size, and does not introduce the compatibility issues that
>fcf-protection=3Dbranch does.

[snip]

>So to reformulate that as a question: why is the advice to remove the
>flag completely, instead of reducing it to fcf-protection=3Dreturn?

This requires kernel support to be effective - and Bookworm does not=20
have a kernel with that flag turned on. I understand there to be no=20
difference between disabling fcf-protection entirely vs return in i386=20
for Bookworm.

The two (related) flags, as Marcos points out earlier in reply to my=20
misunderstanding here too, the related toggle here is
CONFIG_X86_USER_SHADOW_STACK, which is required for=20
fcf-protection=3Dreturn

FWIW; these flags were set specifically in sudo upstream -- not Debian's=20
cross-distro default flags. Upstream has since removed them, for the=20
same reason(s) as we resolved here. If we wanted to rebuild the distro=20
to take advantage of the (new!) enablement of the=20
CONFIG_X86_USER_SHADOW_STACK=3Dy
in the sid x86_64 kernel running i386 binaries (or even amd64 binaries),=20
I reckon we'd need to do some work across the archive.

In that case we'd want to use fcf-protection=3Dreturn, rather than
fcf-protection=3Dfull, as I understand it, since we can't take meaningful=
=20
advantage of the IBT -- since the CONFIG_X86_KERNEL_IBT flag is for=20
kernelspace not userspace, and there's no reason to turn that on for=20
userspace programs.

FWIW, I stand by the advice; it's good. There is no difference between=20
disabling fcf-protection entirely and setting return, since no bookworm=20
kernels will do anything different with =3Dreturn.

I agree with Helmut's reading on his ctte vote, and I share it=20
completely.

   paultag

--=20
   =E2=A2=80=E2=A3=B4=E2=A0=BE=E2=A0=BB=E2=A2=B6=E2=A3=A6=E2=A0=80         =
      Paul Tagliamonte <paultag>
   =E2=A3=BE=E2=A0=81=E2=A2=A0=E2=A0=92=E2=A0=80=E2=A3=BF=E2=A1=81  https:/=
/people.debian.org/~paultag | https://pault.ag/
   =E2=A2=BF=E2=A1=84=E2=A0=98=E2=A0=B7=E2=A0=9A=E2=A0=8B        Debian, th=
e universal operating system.
   =E2=A0=88=E2=A0=B3=E2=A3=84=E2=A0=80=E2=A0=80  4096R / FEF2 EB20 16E6 A8=
56 B98C  E820 2DCD 6B5D E858 ADF3

--MyHF+hSrGNiUZrWk
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEE8rctyP6kE7DHa+fOytLPCmgIXzIFAmky7NMACgkQytLPCmgI
XzJ/Ewf+MgJpzf6wSUb/wHUuL3Ouam88BL01BTSCIw0IiE1XHaYnuRzBN4iTyBdw
O75rK+b7y3RJhCxMxYm+Zj+BJaK5/GTxO1RMu1oH0SocHZ+Ch2q8FbSAwT8CxMUN
iLu3CmU20UgT7MfcM1q1sNFPVSMUtYe81VYLrubuehARWFR2jfLjmBXucPSODxsi
G2sPBFg73czESeOIsMFX4HIAAzqOoAdjiO+R32NVcYmdbYOmU9eRvfOvG6uiw8iU
dlQk2xnxzCEd0vpG45C12vc7kJ3Koal48pKHD+GyGIYiQu2CPPDBiaYcTZRXaQuE
e186kQDxfm3m4mjHL8p+Obh0mOmo9g==
=Jb79
-----END PGP SIGNATURE-----

--MyHF+hSrGNiUZrWk--