Bug 2458434

Summary: Enable Shadow Stack protection by default on x86_64 hardware supporting it
Product: [Fedora] Fedora Reporter: Arjun Shankar <ashankar>
Component: glibcAssignee: Arjun Shankar <ashankar>
Status: ASSIGNED --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: rawhideCC: arjun, codonell, dj, fberat, fweimer, jlaw, josmyers, mcermak, mcoufal, mfabian, pfrankli, sipoyare, skolosov, suraj.ghimire7
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2196282, 2458478, 2458657, 2459530, 2459558, 2459565, 2458184, 2459561    
Bug Blocks:    

Description Arjun Shankar 2026-04-14 20:14:52 UTC 
We want to enable Shadow Stack protection by default on x86_64 machines that support it on Fedora Linux 45. The dynamic linker will activate Shadow Stack for any process whose binary and shared library dependencies are all built with Shadow Stack support, protecting processes by default whenever possible.

https://fedoraproject.org/wiki/Changes/ShadowStack

Reproducible: Always
Comment 1 Arjun Shankar 2026-04-19 16:31:17 UTC 
Missing support in rust-rpm-sequoia needs to come via a rust toolchain enhancement.
Comment 2 Arjun Shankar 2026-04-19 18:11:34 UTC 
glycin (glycin-libs and glycin-loaders) also depend on the rustc enhancement.
Comment 3 Arjun Shankar 2026-04-19 20:15:06 UTC 
librsvg2 also depends on the rustc enhancements.
Comment 4 Arjun Shankar 2026-04-19 22:31:51 UTC 
mozjs140 and rust-rav1e also depend on the rustc enhancement.
Comment 5 Arjun Shankar 2026-04-19 23:02:20 UTC 
This completes the initial testing and analysis work.