[gentoo-dev] Re: Profile 23.0 testing with stages and binhost (part 2 of 2)

[Duncan <1i5t5.duncan@cox.net>]

Andreas K. Huettel posted on Fri, 15 Mar 2024 19:12:54 +0100 as excerpted:

> Note 3: amd64 now has CET turned on by default.
> https://docs.kernel.org/next/x86/shstk.html If you have already used the
> unannounced 23.0 profiles, you should wipe your package cache and emerge
> -ev world now.

There's not much about CET in any of the links.  While the kernel.org link 
describes what it does (in a line, "yese": yet another security 
enhancement) a bit, it doesn't say how to actually find whether your 
hardware supports it, and the gentoo wiki and bug links say even less -- 
in particular, unless I missed it, the changes and update instructions 
links don't appear to mention CET or shadow-stacks AT ALL.

What I ended up doing here after some DDG googling, was emerging cpuid, 
then doing:

$$ cpuid -1 | grep -i 'cet\|shadow'
CET_SS: CET shadow stack                 = false
CET_IBT: CET indirect branch tracking    = false
CET_U user state                     = false
CET_S supervisor state               = false
supervisor shadow stack                 = false

With all of those false it would seem CET can't work here in any case so 
there's no point rebuilding again, which is what I already suspected but 
wanted to /know/.  (I've been on a 23.0 merged-usr profile[1] for some 
time now as I already had much of what it does already enabled before the 
new profiles were announced here, so it /would/ be "rebuilding again" to 
get that, but as it seems it won't do anything useful anyway...)

Clearer instructions for finding that out (and preferably what actually 
has to be true, I still don't know that for sure) so others don't have to 
google it, could be useful.

---
[1] Already on a merged-usr profile:  Of course including developing an 
auto-applied-on-update patch to do s:[[ ! -h "${EROOT%/}/bin" ]]:false: to 
the profile bashrc after that test was added, because I am indeed usr-
merged (on systemd) here but that test fails because the operating symlink 
is /usr -> . instead, aka reverse-usrmerge.  Tho making the canonical 
path /realbin and doing /bin -> /realbin  would appear to satisfy the test 
too, and would allow me to avoid patching the profile bashrc, but at least 
here, having /bin be the system's real bin location is part of the _point_ 
of a reverse-usrmerge.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman