Re: RFC: Shadow Stack support in glibc

["H.J. Lu" <hjl dot tools at gmail dot com>]

On Mon, Jun 5, 2017 at 3:41 PM, Paul Eggert <eggert@cs.ucla.edu> wrote:
> On 06/05/2017 02:36 PM, H.J. Lu wrote:
>>
>> To enable Shadow Stack in glibc, there are 2 approaches:
>>
>> 1. Only support Shadow Stack in getcontext/setcontext and disallow
>> makecontext/swapcontext when Shadow Stack is used.
>> 2. Disallow getcontext/setcontext/makecontext/swapcontext when
>> when Shadow Stack is used.
>
>
> The latter sounds simpler. Do you know of applications that would benefit
> from the former?

I don't know how useful they are without makecontext/swapcontex.

> By "disallow" do you mean that getcontext and makecontext return -1 and set
> errno to ENOTSUP, or were you thinking of something else?

A single copy of libc has getcontext/setcontext/makecontext/swapcontext.
They work fine as long as Shadow Stack isn't used.  We can add

#if SHADOW STACK is enabled
# error getcontext/setcontext/makecontext/swapcontext can't be used
with Shadow Stack.
#endif

to <ucontext.h>.

>> If we decide to disallow getcontext/setcontext/makecontext/swapcontext
>> when Shadow Stack is used, should we add a new set of functions
>> compatible with Shadow Stack to manipulate user context?
>
>
> What would this new set of functions look like, and how would one modify an

The main issue is that an explicit "freecontext" function call is needed
to free shadow stack when context is no longer needed.   We need to
investigate how to modify each program to add freecontext call.

> application to use them? If getcontext/etc. are rarely used it might not be
> worth designing replacements.
>

makecontext, getcontext and setcontext are used in libgo.

-- 
H.J.