[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1063515: marked as done (glibc: Please build with -mbranch-protection=standard on arm64 to enable PAC/BTI support)

Your message dated Mon, 22 Jul 2024 21:21:31 +0000
with message-id <E1sW0TL-001GPW-Si@fasolo.debian.org>
and subject line Bug#1063515: fixed in glibc 2.39-5
has caused the Debian Bug report #1063515,
regarding glibc: Please build with -mbranch-protection=standard on arm64 to enable PAC/BTI support
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1063515: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063515
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: glibc
Version: 2.37-15
Severity: wishlist
Tags: patch
User: debian-arm@lists.debian.org
Usertags: arm64
Control: block -1 by 1057469

Hi,

As discussed on the debian-glibc mailing list [1], please consider
building glibc on arm64 with -mbranch-protection=standard to enable
support for the PAC/BTI security features in Debian.

The discussion on the mailing list ended up with an agreement on the
attached patch proposed by Aurelien Jarno which works fine in my tests.

In order to properly support PAC/BTI in Debian we need first GCC to
enable support for the feature, and that has not happened yet. For this
reason I'm marking this bug as blocked-by the relevant issue filed
against gcc-12: #1057469.

[1] https://lists.debian.org/debian-glibc/2023/12/msg00022.html

--- glibc-2.37/debian/sysdeps/arm64.mk
+++ glibc-2.37/debian/sysdeps/arm64.mk
@@ -1,2 +1,5 @@
 # configuration options for all flavours
 extra_config_options = --enable-multi-arch --enable-memory-tagging
+
+CC = $(DEB_HOST_GNU_TYPE)-$(BASE_CC)$(DEB_GCC_VERSION) -mbranch-protection=standard
+CXX = $(DEB_HOST_GNU_TYPE)-$(BASE_CXX)$(DEB_GCC_VERSION) -mbranch-protection=standard

--- End Message ---
--- Begin Message --- 
Source: glibc
Source-Version: 2.39-5
Done: Aurelien Jarno <aurel32@debian.org>

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1063515@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 22 Jul 2024 22:58:49 +0200
Source: glibc
Architecture: source
Version: 2.39-5
Distribution: unstable
Urgency: medium
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Closes: 1063515 1076512
Changes:
 glibc (2.39-5) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * debian/patches/hurd-i386/git-pthread_self{,.2}.diff: Fix pthread_self()
     without libpthread.
 .
   [ Aurelien Jarno ]
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fixes stdlib/tst-swapcontext2 test on hppa.  Closes: #1076512.
   * debian/rules.d/tarball.mk: remove useless code.
   * debian/sysdeps/arm64.mk: compile with -mbranch-protection=standard on
     arm64 to enable PAC/BTI support.  Closes: #1063515.
   * debian/control.in/main: build-depends on g++13-for-host (>= 13.3.0-3) on
     arm64 to ensure PAC/BTI support in GCC.
Checksums-Sha1:
 e06c4b84243c276c0773273f805c063ec6d20ded 7550 glibc_2.39-5.dsc
 a0a254d55bd1af93aaf68596babe5e3ba6eb0cea 451712 glibc_2.39-5.debian.tar.xz
 1d81324b13aae5a85842135933d282f25ddb035b 10995 glibc_2.39-5_source.buildinfo
Checksums-Sha256:
 a4457c0ee747e243d3c303dfa6c3b2319dee158661f53008914ba1fd5efcaf26 7550 glibc_2.39-5.dsc
 16fa415e66f58f0a39798993c731362c895aeee791f237d6193dd02f37dbb7ab 451712 glibc_2.39-5.debian.tar.xz
 48f7dd4cfe1915727a688aa24810d18bec838e33bd0918272adea7a35f3e646b 10995 glibc_2.39-5_source.buildinfo
Files:
 3a5abec6dc04f2c68a0355c0599bf6db 7550 libs required glibc_2.39-5.dsc
 0fb3b514346624eb8d34b86c79949a9c 451712 libs required glibc_2.39-5.debian.tar.xz
 eb032a22da7cfd5795bed0c3fea07c96 10995 libs required glibc_2.39-5_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUryGlb40+QrX1Ay4E4jA+JnoM2sFAmaeyLUACgkQE4jA+Jno
M2vPsA//bLlRA9YgEjonVi5QCTnbizCnIDn3yBV0zywUVF6Q5BZjyWFN6vnshnb4
03y6kUUzylBWHu/87j4DmB/GH7yP5Vp9TtpLlEiXqKdqzGB0all5vS/iBuWGkA0b
KGK+dZ/0rsP79kr24Yya9qgF4FhGvUWkK8wGXwYEZpcHShE0D2j5dA7koGCbWFaj
atYYTWr2b8s6sfuTq6eDuhMI8vZqvnXwf+5Ens45YfyihVBD0nTmhgglGK5I5tMQ
Q7zWZ3d7u/0NRMdxAghAFZTzQZw+cBictabSpaw0utE6D5JYkdbp2MlxlJ67/Cmq
YArnsoV8R9NXCBP3AuM8UyjberW+/eLw2ylYNRnv7Yf2BG+Ug2+GDROQ35CXYuBN
XM+2Ku4owK2vyGhzKrbF7tBdpa5afm3V0ocaQBQUbsijwL35+B2JnDxuMd2Sao+x
iUblNMuS6W7aF+VFZ1E6lXTaBRlyQWCWxDF/PUxLgKiyT3+WInY/hy/EUOZX4KQa
gjZcrJa63fhgD9sYBzznJAim3papLMMAjrWKmIbg+AifCH9cIoUKGkxDdcZVOjDc
OB5V8alzwtthoLMtQAmIZX3MYiFmfEq+Mw2wOU7HxHyBwwpFNv49mJN4LMA4fMME
HyvjyU/3ysSj6G0V9C7IlTRhFoSm4g4f07VXILw6hUVrG5Q0WSo=
=cmbx
-----END PGP SIGNATURE-----

Attachment: pgpKfhJOwQwRS.pgp
Description: PGP signature


--- End Message ---
Reply to: