# Re: \[PATCH v11 9/9\] x86: Disallow vsyscall emulation when CET is enabled

- List: linux-api
- 2 messages, 2 authors
- Page: https://ratatoskr.run/linux-api/2020/08/6081982/t

## Re: \[PATCH v11 9/9\] x86: Disallow vsyscall emulation when CET is enabled

- From: Florian Weimer \<hidden\>
- Date: 2020-08-25 09:15:15 
- Message: https://ratatoskr.run/linux-api/2020/08/6081982.md

```text
* Andy Lutomirski:

> On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu [ref] wrote:
>>
>> From: "H.J. Lu" <redacted>
>>
>> Emulation of the legacy vsyscall page is required by some programs built
>> before 2013.  Newer programs after 2013 don't use it.  Disallow vsyscall
>> emulation when Control-flow Enforcement (CET) is enabled to enhance
>> security.
>
> NAK.
>
> By all means disable execute emulation if CET-IBT is enabled at the
> time emulation is attempted, and maybe even disable the vsyscall page
> entirely if you can magically tell that CET-IBT will be enabled when a
> process starts, but you don't get to just disable it outright on a
> CET-enabled kernel.

Yeah, we definitely would have to revert/avoid this downstream.  People
definitely want to run glibc-2.12-era workloads on current kernels.
Thanks for catching it.

Florian

```

## Re: \[PATCH v11 9/9\] x86: Disallow vsyscall emulation when CET is enabled

- From: Yu, Yu-cheng \<hidden\>
- Date: 2020-08-25 15:09:00 
- Message: https://ratatoskr.run/linux-api/2020/08/6082399.md

```text
On 8/25/2020 2:14 AM, Florian Weimer wrote:
> * Andy Lutomirski:
>
>> On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu [ref] wrote:
>>>
>>> From: "H.J. Lu" <redacted>
>>>
>>> Emulation of the legacy vsyscall page is required by some programs built
>>> before 2013.  Newer programs after 2013 don't use it.  Disallow vsyscall
>>> emulation when Control-flow Enforcement (CET) is enabled to enhance
>>> security.
>>
>> NAK.
>>
>> By all means disable execute emulation if CET-IBT is enabled at the
>> time emulation is attempted, and maybe even disable the vsyscall page
>> entirely if you can magically tell that CET-IBT will be enabled when a
>> process starts, but you don't get to just disable it outright on a
>> CET-enabled kernel.
>
> Yeah, we definitely would have to revert/avoid this downstream.  People
> definitely want to run glibc-2.12-era workloads on current kernels.
> Thanks for catching it.
>

That makes sense.  I will update the patch.

Thanks,
Yu-cheng
```