Bug#1113774: Disabling -fcf-protection in sudo for bookworm

[Paul Tagliamonte <paultag@debian.org>]

On Fri, Dec 05, 2025 at 12:38:59PM +0000, James Addison wrote:
> My reading of the thread is that fcf-protection=return can be
> security-effective on 32-bit x86 processors, has no effect on binary
> size, and does not introduce the compatibility issues that
> fcf-protection=branch does.

[snip]

> So to reformulate that as a question: why is the advice to remove the
> flag completely, instead of reducing it to fcf-protection=return?

This requires kernel support to be effective - and Bookworm does not 
have a kernel with that flag turned on. I understand there to be no 
difference between disabling fcf-protection entirely vs return in i386 
for Bookworm.

The two (related) flags, as Marcos points out earlier in reply to my 
misunderstanding here too, the related toggle here is
CONFIG_X86_USER_SHADOW_STACK, which is required for 
fcf-protection=return

FWIW; these flags were set specifically in sudo upstream -- not Debian's 
cross-distro default flags. Upstream has since removed them, for the 
same reason(s) as we resolved here. If we wanted to rebuild the distro 
to take advantage of the (new!) enablement of the 
CONFIG_X86_USER_SHADOW_STACK=y
in the sid x86_64 kernel running i386 binaries (or even amd64 binaries), 
I reckon we'd need to do some work across the archive.

In that case we'd want to use fcf-protection=return, rather than
fcf-protection=full, as I understand it, since we can't take meaningful 
advantage of the IBT -- since the CONFIG_X86_KERNEL_IBT flag is for 
kernelspace not userspace, and there's no reason to turn that on for 
userspace programs.

FWIW, I stand by the advice; it's good. There is no difference between 
disabling fcf-protection entirely and setting return, since no bookworm 
kernels will do anything different with =return.

I agree with Helmut's reading on his ctte vote, and I share it 
completely.

  paultag

--
  ⢀⣴⠾⠻⢶⣦⠀               Paul Tagliamonte <paultag>
  ⣾⠁⢠⠒⠀⣿⡁  https://people.debian.org/~paultag | https://pault.ag/
  ⢿⡄⠘⠷⠚⠋        Debian, the universal operating system.
  ⠈⠳⣄⠀⠀  4096R / FEF2 EB20 16E6 A856 B98C  E820 2DCD 6B5D E858 ADF3

Attachment: signature.asc
Description: PGP signature