Bug 1764581

Summary:	Please enable pointer authentication (PAC) support in glibc for forward compatibility with RHEL8
Product:	Red Hat Enterprise Linux 7	Reporter:	Jeremy Linton (ARM) <jlinton>
Component:	glibc	Assignee:	glibc team <glibc-bugzilla>
Status:	CLOSED NOTABUG	QA Contact:	qe-baseos-tools-bugs
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	ashankar, codonell, dj, fweimer, mnewsome, pfrankli
Target Milestone:	rc
Target Release:	---
Hardware:	aarch64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-29 18:25:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jeremy Linton (ARM) 2019-10-23 11:50:14 UTC

Description of problem: The glibc exception unwinder in RHEL7 doesn't understand PAC pointers. Potentially this library can be linked into containers/etc which may be used on RHEL8+ machines . As such this functionality should be back-ported into RHEL7 to avoid future problems.


Actual results:
At the moment its believed that various combinations of OS/glibc and PAC will cause application crashes rather than correctly handling exceptions.

Upstream patches:

https://sourceware.org/ml/libc-alpha/2019-06/msg00499.html

Comment 2 Florian Weimer 2019-10-23 12:01:48 UTC

Jeremy, the patch has not been merged upstream. My understanding was that the PAC PLT was abandoned, given that it is possible to get much better hardening using BIND_NOW and full RELRO. Would you please clarify? Thanks.

Comment 3 Carlos O'Donell 2019-10-29 18:15:49 UTC

The bug we were expecting from Arm was a bug against gcc for libgcc to be fixed in rhel-7.6.z to support the overlapping unwinding op with the old sparc unwind opcode.

Comment 4 Jeremy Linton (ARM) 2019-10-29 18:25:09 UTC

Lets blame this one on me not reading all the email threads, and close it. I will open another one against the correct component, but I have to track down the right commits.