[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1113774: Disabling -fcf-protection in sudo for bookworm



On Tue, Sep 02, 2025 at 05:14:27PM +0200, Christoph Berg wrote:
Re: Stefano Rivera
It seems that the intention of the new instruction was to be interpreted as
a NOP on older hardware, but that obviously didn't happen on these non-Intel
CPUs.

https://lists.debian.org/debian-devel/2023/10/msg00120.html states
these processors are unsupported.

It's tough because the link is gone now (since it was /testing/ at the time that email was sent) -- but in reply, Ben adds[1]

Sorry, the page I linked is for testing ("trixie", which will become
Debian 13).  Debian 12 "bookworm" is supposed to still support this
CPU.

I also appreciate the detail about this CPU instruction being disused on all bin:i386 even if the kernel is amd64.

I've grown a bit more sympathetic to the argument here; but I'm still not 100% what to think of this.

The natural outcome here seems to be:

  a) do nothing as-is, some fraction of supported but non-intel CPUs will
get runtime failures, since we've altered the ISA baseline and never realized it due to popularity

b) remove this flag from sudo specifically, fixing sudo specifically in bookworm (oldstable)

c) change all i386 package flags for bookworm specifically (oldstable) and binNMU the whole archive, FTBFS and all

  d) declare bookworm i386 retroactively always was a different ISA baseline
     ("We have always been at war with Eastasia")

It seems to me that option "c" here is a nonstarter, even though it's likely the correct way to go about this. If bookworm was still testing and we found this, I can't imagine we'd do anything *except* that route (to Marc's point -- which, I think that's right -- why is sudo special-cased here besides "it's run a lot" and why isn't this archive-wide if it's truely a noop?)

[1]: https://lists.debian.org/debian-devel/2023/10/msg00128.html

--
  ⢀⣴⠾⠻⢶⣦⠀               Paul Tagliamonte <paultag>
  ⣾⠁⢠⠒⠀⣿⡁  https://people.debian.org/~paultag | https://pault.ag/
  ⢿⡄⠘⠷⠚⠋        Debian, the universal operating system.
  ⠈⠳⣄⠀⠀  4096R / FEF2 EB20 16E6 A856 B98C  E820 2DCD 6B5D E858 ADF3

Attachment: signature.asc
Description: PGP signature


Reply to: