[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1113774: Disabling -fcf-protection in sudo for bookworm



Hi

sudo maintainer here.

On Tue, Sep 02, 2025 at 02:48:14PM +0200, Christoph Berg wrote:
did you discuss this with the sudo maintainer?

They did. I said no.

The Geode is an i586 machine that doesn't support the full i686 instruction set. As far as I know, we stopped supporting i586 iterally decades ago.

The OP is suggesting to disable a security feature for i386 so that sudo (and other software that uses -fcf-protection) can run on their CPU that was never officially supported in bookworm. They're claiming that this option is a no-op on i386 anyway, but why is it enabled in our toolchain then? Should this issue not be addressed in the toolchain?

When I asked for clarification I got screenfuls of technobabble. I am neither a toolchain person nor a kernel person. I am just responsible for a security relevant package.

That's why I said - repeatedly - no to the request.

I am open to advice from the TC since I know that I can trust you.

Greetings
Marc


--
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421


Reply to: