Bug 2458184

Summary:	Drop -fcf-protection flag during Firefox builds
Product:	[Fedora] Fedora	Reporter:	Arjun Shankar <ashankar>
Component:	firefox	Assignee:	Martin Stransky <stransky>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	43	CC:	fweimer, gecko-bugs-nobody, jhorak, klaas, rstrode, sagitterghostproton.me, stransky, suraj.ghimire7
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	firefox-152.0.4-3.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-07-10 09:14:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2458434

Description Arjun Shankar 2026-04-14 11:55:58 UTC

Running Firefox with shadow stack support enabled on a system with appropriate support (11th or newer gen Intel CPU) leads to an error at startup when the firefox runtime attempts to load /usr/lib64/firefox/libgkcodecs.so:

$ GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK /usr/bin/firefox 
XPCOMGlueLoad error for file /usr/lib64/firefox/libgkcodecs.so:
/usr/lib64/firefox/libgkcodecs.so: rebuild shared object with SHSTK support enabled
Couldn't load XPCOM.

Some background for why this bug is being filed and marked with a "High" severity:

We (the glibc team) are planning to enable Shadow Stack protection by default in Fedora 45, and this bug report is a result of early testing. Here is a WIP/draft Fedora System-Wide Change Proposal: https://fedoraproject.org/wiki/Changes/ShadowStack

In the case of Firefox, it appears that while the primary firefox binary and objects it directly links against are built with SHSTK support (and therefore the program is started by the loader with SHSTK support on, some objects that are loaded by firefox *after* program startup via dlopen are not. Here is a more complete report of which objects are built with and which without support:

  NO /usr/lib64/firefox/crashhelper
  NO /usr/lib64/firefox/crashreporter
  YES /usr/lib64/firefox/firefox
  YES /usr/lib64/firefox/firefox-bin
  YES /usr/lib64/firefox/glxtest
  YES /usr/lib64/firefox/gmp-clearkey/0.1/libclearkey.so
  NO /usr/lib64/firefox/libgkcodecs.so
  YES /usr/lib64/firefox/liblgpllibs.so
  YES /usr/lib64/firefox/libmozavcodec.so
  YES /usr/lib64/firefox/libmozavutil.so
  YES /usr/lib64/firefox/libmozgtk.so
  YES /usr/lib64/firefox/libmozinference.so
  YES /usr/lib64/firefox/libmozsandbox.so
  YES /usr/lib64/firefox/libmozsqlite3.so
  YES /usr/lib64/firefox/libmozwayland.so
  NO /usr/lib64/firefox/libxul.so
  YES /usr/lib64/firefox/pingsender
  YES /usr/lib64/firefox/vaapitest

As far as I can tell, this is due to some asm files that are not annotated. There are some notes in the Documentation section of the change proposal on how to identify and fix issues such as these, although it does not apply directly to nasm:
https://fedoraproject.org/wiki/Changes/ShadowStack#Documentation

Reproducible: Always

Steps to Reproduce:
1. Use a machine with SHSTK support: cat /proc/cpuinfo | grep shstk
2. Run firefox with SHSTK on: GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK /usr/bin/firefox
Actual Results:
XPCOMGlueLoad error for file /usr/lib64/firefox/libgkcodecs.so:
/usr/lib64/firefox/libgkcodecs.so: rebuild shared object with SHSTK support enabled
Couldn't load XPCOM.

Expected Results:
Firefox does not crash, and runs with SHSTK support on

Comment 1 Martin Stransky 2026-04-22 11:38:17 UTC

That's something we may want to bring upstream at bugzilla.mozilla.org. Is that gcc/glib specific? Does it affects Mozilla builds too?
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries
Thanks.

Comment 2 Florian Weimer 2026-07-09 09:27:10 UTC

(In reply to Martin Stransky from comment #1)
> That's something we may want to bring upstream at bugzilla.mozilla.org. Is
> that gcc/glib specific? Does it affects Mozilla builds too?
> https://fedoraproject.org/wiki/
> How_to_debug_Firefox_problems#Testing_Mozilla_binaries

It does not impact Mozilla binaries because they do not use the Fedora build flags. The crash will go way if you remove -fcf-protection from the build flags. This way, the main Firefox binary will be marked as incompatible, and the process will remain in legacy mode (shadow stack is never turned on).

Comment 3 Arjun Shankar 2026-07-09 11:31:00 UTC

The JIT is the major blocker here and until upstream fixes it (https://bugzilla.mozilla.org/show_bug.cgi?id=1902244), we cannot have shadow stack protection for Firefox. In the meanwhile, we should drop the -fcf-protection flag during Firefox builds by adjusting the spec file.

Comment 4 Martin Stransky 2026-07-10 09:14:45 UTC

Added to firefox-152.0.4-3.

Comment 5 Fedora Update System 2026-07-10 13:06:00 UTC

FEDORA-2026-0cd8472f57 (firefox-152.0.4-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-0cd8472f57

Comment 6 Fedora Update System 2026-07-10 13:54:37 UTC

FEDORA-2026-0cd8472f57 (firefox-152.0.4-3.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.