Bug#1021292: Enabling branch protection on amd64 and arm64

2023-08-31 Thread Helmut Grohne
Hi Guillem, On Thu, Aug 31, 2023 at 02:12:51AM +0200, Guillem Jover wrote: > So this happened, and Johannes reported that this seems to be breaking > cross-building. :( > > The problem, which is in fact not new, but is made way more evident > now, is that the flags used are accepted only per arch

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-08-31 Thread Emanuele Rocca
Hi Guillem, On 2023-08-31 02:12, Guillem Jover wrote: > So this happened, and Johannes reported that this seems to be breaking > cross-building. :( > > The problem, which is in fact not new, but is made way more evident > now, is that the flags used are accepted only per arch, so when > passing f

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-08-30 Thread Guillem Jover
Hi! On Sun, 2023-08-27 at 12:51:53 +0200, Guillem Jover wrote: > On Tue, 2023-06-27 at 16:09:40 +0100, Wookey wrote: > > OK. We're all agreed on that then. Guillem can stick it in the next > > dpkg upload. So this happened, and Johannes reported that this seems to be breaking cross-building. :(

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-08-27 Thread Guillem Jover
Hi! On Tue, 2023-06-27 at 16:09:40 +0100, Wookey wrote: > On 2023-06-27 16:58 +0200, Moritz Mühlenhoff wrote: > > Am Wed, Jun 21, 2023 at 05:41:36PM +0200 schrieb Emanuele Rocca: > > > On 2022-10-26 08:20, Moritz Mühlenhoff wrote: > > > > I think this should rather be applied early after the Bookw

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-06-27 Thread Wookey
On 2023-06-27 16:58 +0200, Moritz Mühlenhoff wrote: > Am Wed, Jun 21, 2023 at 05:41:36PM +0200 schrieb Emanuele Rocca: > > Hey Moritz, > > > > On 2022-10-26 08:20, Moritz Mühlenhoff wrote: > > > I think this should rather be applied early after the Bookworm > > > release (and ideally we can also f

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-06-27 Thread Moritz Mühlenhoff
Am Wed, Jun 21, 2023 at 05:41:36PM +0200 schrieb Emanuele Rocca: > Hey Moritz, > > On 2022-10-26 08:20, Moritz Mühlenhoff wrote: > > I think this should rather be applied early after the Bookworm > > release (and ideally we can also finish off the necessary testing > > and add -fstack-clash-protec

Bug#1021292: Enabling branch protection on amd64 and arm64

2023-06-21 Thread Emanuele Rocca
Hey Moritz, On 2022-10-26 08:20, Moritz Mühlenhoff wrote: > I think this should rather be applied early after the Bookworm > release (and ideally we can also finish off the necessary testing > and add -fstack-clash-protection at least for amd64 and other archs > which are ready for it (#918914)).

Bug#1021292: Enabling branch protection on amd64 and arm64

2022-10-25 Thread Wookey
On 2022-10-25 16:10 +0100, Simon McVittie wrote: > On Tue, 25 Oct 2022 at 15:34:26 +0100, Wookey wrote: > > These are hardware features (new instructions) that 'tag' pointers and > > branch targets to make it much harder for malicious code to implement > > ROP (return oriented programming) and JOP

Bug#1021292: Enabling branch protection on amd64 and arm64

2022-10-25 Thread Simon McVittie
On Tue, 25 Oct 2022 at 15:34:26 +0100, Wookey wrote: > These are hardware features (new instructions) that 'tag' pointers and > branch targets to make it much harder for malicious code to implement > ROP (return oriented programming) and JOP (Jump oriented programming) > attacks. > > They have bee

Bug#1021292: Enabling branch protection on amd64 and arm64

2022-10-25 Thread Wookey
I have been in discussion with Guillem about enabling the various branch protection mechanisms available on newer x86 and arm CPUs. These are hardware features (new instructions) that 'tag' pointers and branch targets to make it much harder for malicious code to implement ROP (return oriented prog