# Re: \[PATCH v11 9/9\] x86: Disallow vsyscall emulation when CET is enabled

- From: Yu, Yu-cheng \<hidden\>
- Date: 2020-08-25 15:09:00 
- List: linux-api
- Page: https://ratatoskr.run/linux-api/2020/08/6082399
- Thread: https://ratatoskr.run/linux-doc/2020/08/6081982/t.md

```text
On 8/25/2020 2:14 AM, Florian Weimer wrote:
> * Andy Lutomirski:
>
>> On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu [ref] wrote:
>>>
>>> From: "H.J. Lu" <redacted>
>>>
>>> Emulation of the legacy vsyscall page is required by some programs built
>>> before 2013.  Newer programs after 2013 don't use it.  Disallow vsyscall
>>> emulation when Control-flow Enforcement (CET) is enabled to enhance
>>> security.
>>
>> NAK.
>>
>> By all means disable execute emulation if CET-IBT is enabled at the
>> time emulation is attempted, and maybe even disable the vsyscall page
>> entirely if you can magically tell that CET-IBT will be enabled when a
>> process starts, but you don't get to just disable it outright on a
>> CET-enabled kernel.
>
> Yeah, we definitely would have to revert/avoid this downstream.  People
> definitely want to run glibc-2.12-era workloads on current kernels.
> Thanks for catching it.
>

That makes sense.  I will update the patch.

Thanks,
Yu-cheng
```