Re: F45 Change Proposal: Enable Shadow Stack by Default on x86_64 (system-wide)

On Wed, Jul 01, 2026 at 05:10:00PM +0100, Aoife Moloney via devel-announce wrote:
> == Upgrade/compatibility impact ==
> After upgrading to Fedora 45, Shadow Stack support will be enabled
> automatically for processes whose binary and all loaded shared
> libraries carry the appropriate markup. Processes that load any
> non-compliant shared object will have Shadow Stack silently disabled
> at startup.

Is anyone aware of any other mainstream distros that have enabled
Shadow Stack yet, or is Fedora going to be the first to get the
visibility of any potential lurking incompatibilities ?


> == User Experience ==
> This change is transparent to users. No action is required to enable
> or configure support. Applications that are not compatible with Shadow
> Stack run without the protection; they continue to function normally
> but do not benefit from the additional security. In rare cases, an
> application that loads a non-compliant plugin at runtime may encounter
> a `dlopen` error. Known affected applications ship with a drop-in
> configuration file that prevents this. Users who encounter this with
> other applications can create a file in `/etc/tunables.conf.d/` to opt
> the application out, and then run `ldconfig`.

"encounter a dlopen error" is rather vague.

What is the exact behaviour that users will see when an app dlopens
a library that is not shadow stack compatible ?  Will the application
in question crash/abort, or will it report a generic or specific error
message and can apps expect to gracefully degrade in some manner ?

How will users diagnose that the problem is specifically related
to shadow stacks incompatiblity, in order to know to turn off
the feature ?


Editting an /etc/tunables.conf.d file is not going to be so nice if
users are dealing with pre-built containers from a 3rd party.

Is there any system global mechanism to turn off ShadowStacks that
would be inherited by containers too ? I guess since this sounds
like purely a glibc control mechanism, there's no kernel cmdline
boot arg to disable this feature ?

IOW if any containers were affected, users would need to mount an
override for /etc/tunables.conf.d

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new