On 01/07/2026 18:10, Aoife Moloney via devel-announce wrote:
This change enables Shadow Stack protection on applications and libraries built with gcc (C, C++), clang (C, C++), and rustc (Rust) by default on x86_64 machines that support it on Fedora Linux 45. The dynamic linker or static startup routines will activate Shadow Stack for any process whose binary and shared library dependencies are all built with Shadow Stack support (marked with ELF metadata), protecting processes by default whenever possible.
Have you done any comparative analysis of the performance impact of this change?
The only exception is applications that are fully Shadow Stack compliant at startup and then use `dlopen` to load a shared object without Shadow Stack markup at runtime. This will lead to a `dlopen` failure.
It looks like it can break NVIDIA cuda/drivers, Steam and other proprietary applications, and third-party FOSS builds.
1. Shadow Stack hardware support is available on Intel 11th Generation and newer CPUs, and AMD Zen3 and newer CPUs, so testing does not require any special hardware except a recent enough x86_64 processor.
What about older CPUs? -- Sincerely, Vitaly Zaitsev ([email protected]) -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
