Bug#1113864: Replace -fcf-protection=full with -fcf-protection=return

El 03/09/2025 a las 17:47, Guillem Jover escribió:
> Hi!
> 
> On Wed, 2025-09-03 at 16:24:50 +0200, Marcos Del Sol Vives wrote:
>> Package: dpkg-dev
>> Version: 1.22.21
>> Priority: wishlist
>> X-Debbugs-Cc: [email protected]
> 
>> Currently, on amd64 and i386 as of Trixie, packages are being built by
>> default with -fcf-protection=full. This results in shadow stacks and IBT
>> (branch tracking) being enabled on binaries.
> 
> dpkg-buildflags only emits «-fcf-protection» on amd64.

My bad! I am not familiar with dpkg-dev's source code nor autoconf scripts,
and since the first result of -fcf-protection did not indicate any kind
of filtering (https://salsa.debian.org/dpkg-team/dpkg/-/blob/main/m4/dpkg-compiler.m4),
I thought it was actually being applied to everything!

I found now the real code that enables it at
https://salsa.debian.org/dpkg-team/dpkg/-/blob/main/scripts/Dpkg/Vendor/Debian.pm#L637-650
and yes, you're absolutely right, it's amd64-only!

> So, disabling the full CET would regress the current support and make
> enabling it fully in the future harder.
> 
> But it's not clear to me what's the status of submission for userland
> IBT in Linux.

Seems based on a random GitHub Gist that enabling (at least for testing)
IBT in user-land is fairly straightforward on a Linux kernel:
https://gist.github.com/sroettger/fe66f7eb0cb10a8ebd1454875a7131ea

So I assume considering the little effort required to enable it, that it'll
eventually also land in user-space. I would try enabling it on my machine
out of curiosity with Trixie or Sid, but unfortunately my AMD 8745H does
only support shadow stacks.

> So given the above, I'm inclined to mark this wontfix and close, and
> then "someone" needs to driver the transition to its conclusion.

That's an option, yes.

I opened this issue because I was asked to, and because I would personally
wait until there are IBT-enabled kernels to enable one such flag to perform
proper testing so binaries don't become larger prematurely.

However I see your point enabling it now so all packages don't need to be
recompiled further down with CET could be benefitial for a quicker rollout.

Greetings,
Marcos