On Wed, Jul 21, 2021 at 11:34:53AM -0700, Yu, Yu-cheng wrote:

On 7/21/2021 11:28 AM, Florian Weimer wrote:

quoted

I expect that container runtimes turn clone3 into clone in the same way
(via ENOSYS), at least for the medium term.  So it would make sense to
allocate some sort of shadow stack for clone as well, if that's possible
to implement in some way.

Thanks,
Florian

Thanks Florian!  And because of that reason, we will put back clone2 support
in my next v28 patches.

Yu-cheng

I tested with v28 of the patches on the same system and it appears to
fix the issue I was seeing.

Thanks,
John