On CET machine, I got Jan 07 13:44:23 gnu-tgl-1.sc.intel.com su[1687]: PAM unable to dlopen(/usr/lib64/security/pam_fprintd.so): /lib64/libgcrypt.so.20: shadow stack isn't enabled: Invalid argument
hjl/cet/LIBGCRYPT-1.8-BRANCH and hjl/cet/master branches at https://gitlab.com/cet-software/libgcrypt have patches to enable CET. Can someone from Fedora work with me to upstream them?
Unfortunately I do not have much influence on what upstream accepts or not. I'd suggest opening a task on https://dev.gnupg.org/ with a pointer to your gitlab repository.
(In reply to Tomas Mraz from comment #2) > Unfortunately I do not have much influence on what upstream accepts or not. > I'd suggest opening a task on https://dev.gnupg.org/ with a pointer to your > gitlab repository. My patches have been checked into master branch. Will Fedora take master branch?
No, but I can try to backport them myself, or if you want to help, please provide a backported patch.
(In reply to Tomas Mraz from comment #4) > No, but I can try to backport them myself, or if you want to help, please > provide a backported patch. See: https://gitlab.com/cet-software/libgcrypt/tree/hjl/cet/LIBGCRYPT-1.8-BRANCH
As I've backported some AES related improvements from master in rawhide build https://koji.fedoraproject.org/koji/buildinfo?buildID=1497377, it would be nice if you could please verify that I did not break the CET support with this backport.
It is OK: $ readelf -n libgcrypt.so.20 2>&1 | grep IBT Properties: x86 feature: IBT, SHSTK