Re: [RFC][PATCH 6/6] objtool: Add IBT validation / fixups

Joao Moreira
2022-02-09T05:27:23Z

> Ah, excellent, thanks for the pointers. There's also this in the works:
> https://reviews.llvm.org/D119296 (a new CFI mode, designed to play nice
> to objtool, IBT, etc.)

Oh, great! Thanks for pointing it out. I guess I saw something with a
similar name before ;)
https://www.blackhat.com/docs/asia-17/materials/asia-17-Moreira-Drop-The-Rop-Fine-Grained-Control-Flow-Integrity-For-The-Linux-Kernel.pdf

Jokes aside (and perhaps questions more targeted to Sami), from a
diagonal look it seems that this follows the good old tag approach
proposed by PaX/grsecurity, right? If this is the case, should I assume
it could also benefit from features like -mibt-seal? Also are you
considering that perhaps we can use alternatives to flip different CFI
instrumentation as suggested by PeterZ in another thread?

Tks,
Joao