Bug#1113774: Disabling -fcf-protection in sudo for bookworm

[Marcos Del Sol Vives <marcos@orca.pet>]

El 02/09/2025 a las 17:28, Paul Tagliamonte escribió:
> The natural outcome here seems to be:
> 
>   a) do nothing as-is, some fraction of supported but non-intel CPUs will
>      get runtime failures, since we've altered the ISA baseline and
>      never realized it due to popularity
> 
>   b) remove this flag from sudo specifically, fixing sudo specifically
>      in bookworm (oldstable)
> 
>   c) change all i386 package flags for bookworm specifically (oldstable)
>      and binNMU the whole archive, FTBFS and all
> 
>   d) declare bookworm i386 retroactively always was a different ISA baseline
>      ("We have always been at war with Eastasia")

Hello Paul,

B would be in my opinion the solution. So far, I have not found any other
package that has these issues. Not even running a full-fledged desktop
environment (XFCE with X11) has been an issue.

This flag is present on sudo, because the "hardening.m4" file it contains
explicitelly enabled "-fcf-protection".

Considering all reports I've personally seen of illegal instruction on
these kind i686 processors have been limited to "sudo" in Debian, Gentoo
and other BSDs, I assume the amount of packages that I assumed have enabled
"-fcf-protection=full" or "-fcf-protection=branch" will be probably
minimal.

Greetings,
Marcos