Re: F45 Change Proposal: Enable Shadow Stack by Default on x86_64 (system-wide)

On 01/07/2026 18:10, Aoife Moloney via devel-announce wrote:
> This change enables Shadow Stack protection on applications and
> libraries built with gcc (C, C++), clang (C, C++), and rustc (Rust) by
> default on x86_64 machines that support it on Fedora Linux 45. The
> dynamic linker or static startup routines will activate Shadow Stack
> for any process whose binary and shared library dependencies are all
> built with Shadow Stack support (marked with ELF metadata), protecting
> processes by default whenever possible.

Have you done any comparative analysis of the performance impact of this 
change?

> The only exception is applications that are fully Shadow Stack
> compliant at startup and then use `dlopen` to load a shared object
> without Shadow Stack markup at runtime. This will lead to a `dlopen`
> failure.

It looks like it can break NVIDIA cuda/drivers, Steam and other 
proprietary applications, and third-party FOSS builds.

> 1. Shadow Stack hardware support is available on Intel 11th Generation
> and newer CPUs, and AMD Zen3 and newer CPUs, so testing does not
> require any special hardware except a recent enough x86_64 processor.

What about older CPUs?

-- 
Sincerely,
   Vitaly Zaitsev ([email protected])
-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new