On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu <[email protected]> wrote: > > From: "H.J. Lu" <[email protected]> > > Emulation of the legacy vsyscall page is required by some programs built > before 2013. Newer programs after 2013 don't use it. Disallow vsyscall > emulation when Control-flow Enforcement (CET) is enabled to enhance > security.
NAK. By all means disable execute emulation if CET-IBT is enabled at the time emulation is attempted, and maybe even disable the vsyscall page entirely if you can magically tell that CET-IBT will be enabled when a process starts, but you don't get to just disable it outright on a CET-enabled kernel.
