Status of Intel CET in Debian

--=-1VD5kjTou9rrySecTp20
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello everyone

According to the Trixie release notes, Debian 13 has introduced
hardening against ROP attacks using Intel CET (Control-flow Enforcement
Technology, and similar technologies on other CPUs).

https://www.debian.org/releases/stable/release-notes/whats-new.html#hardeni=
ng-against-rop-and-cop-jop-attacks-on-amd64-and-arm64

However, when I check with fwupdmgr, it says: =E2=80=9CNot supported=E2=80=
=9D

> fwupdmgr security
[...]
> HSI-3
> =E2=9C=94 CET Platform:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Supported
[...]
> Runtime Suffix -!
> =E2=9C=98 CET OS Support:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Not supported

This is odd because all of the conditions appear to be met.

/proc/cpuinfo shows both relevant features:

> Model name:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 13th Gen Intel(R) Core(TM) i7-1370P
[...]
> user_shstk
> ibt

The kernel has both options activated:

> $ grep -E "CONFIG_X86_(CET|USER_SHADOW)" /boot/config-`uname -r`
> CONFIG_X86_CET=3Dy
> CONFIG_X86_USER_SHADOW_STACK=3Dy

The manpage of dpkg-buildflags says it has the relevant build flags set
as default:

> branch
> This setting (since dpkg 1.22.0; enabled by default) adds
> =C2=A0-fcf-protection on amd64 and -mbranch-protection=3Dstandard on arm6=
4
> to CFLAGS, CXXFLAGS, OBJCFLAGS, OBJCXXFLAGS,=C2=A0 FFLAGS=C2=A0 and=C2=A0=
 FCFLAGS.
> This adds branch protection to indirect calls, jumps and returns to
> check whether these are valid at run-time.

> Package: dpkg
> Version: 1.22.21

The kernel documentation says that readelf should show a note in
binaries.

<https://docs.kernel.org/next/arch/x86/shstk.html>

However, it does not show anything CET related on my binaries, e.g.:

> /usr/lib/x86_64-linux-gnu/libc.so.6

What am I missing?

Regards
Stephan

--=-1VD5kjTou9rrySecTp20
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQRB1rjSpCJd8a7h6mNgNUJZCjx8YgUCaO9PaQAKCRBgNUJZCjx8
YmRDAQDnymOGi0HDFgOZUWu7Vr2otlnPOYYgO3k+6RBqdB3GYgD8CwNM0eZJ6Nau
o29Vw0uso1rwqSBzTcHl8EzA1U4I6Qc=
=bINJ
-----END PGP SIGNATURE-----

--=-1VD5kjTou9rrySecTp20--