Re: F45 Change Proposal: Enable Shadow Stack by Default on x86_64 (system-wide)

  I have made a C program that should enable this feature within a
program, before using `execve(2)` to execute a new program, which
according to the kernel docs I've outlined in a previous email,
may inherit shadow stack enablement (it definitely will, if
`clone(2)` is used. If you actually want this to be enabled
system wide, you should have it enabled via `systemd`, rather than
via enforcement of ELF flags.

  FYI, I don't know if this program actually works, since my
hardware doesn't support CET features (this might actually be a
serious concern for people with older hardware pre 2020):

```
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#include <asm/prctl.h>
#include <sys/syscall.h>

char *argve[] = {"tprogram.elf", NULL};

int
main(void)
{
  unsigned long feature;

  feature = ARCH_SHSTK_SHSTK;

  if (syscall(SYS_arch_prctl, ARCH_SHSTK_UNLOCK, feature) < 0)
  {
    fprintf(stderr, "Error (failed to unlock): %s.\n", strerror(errno));
    return 1;
  }

  if (syscall(SYS_arch_prctl, ARCH_SHSTK_ENABLE, feature) < 0)
  {
    fprintf(stderr, "Error (failed to enable): %s.\n", strerror(errno));
    return 1;
  }

  execve("./tprogram.elf", argve, NULL);

  return 0;
}
```

         - C. S. Sushi


Sent with Proton Mail secure email.

On Tuesday, July 14th, 2026 at 17:44, CS Sushi Man via devel <[email protected]> wrote:

> https://www.kernel.org/doc/html/next/x86/shstk.html

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new