On Sun, Feb 21, 2021 at 4:28 AM Dave Chinner [off-list ref] wrote:

On Sun, Feb 21, 2021 at 04:02:55AM +0000, Dimitri John Ledkov wrote:

quoted

The patch in question is specific to Ubuntu and was not submitted by
me to neither Debian or Upstream.

Indeed, this is very distro specific, because of all the other things
that we turn on by default in our toolchain, dpkg build flags, and all
other packages.

This patch if taken at face value, will not enable CET. And will make
the package start failing to build from source, when using older
toolchains that don't support said flag.

Yes, that is exactly what I said when pointing out how to *support
this properly* so it doesn't break builds in environments that do
not support such functionality.

Having it as a configure option allows the configure script to -test
whether the toolchain supports it- and then either fail (enable=yes)
or not use it (enable=probe) and continue the build without it.

quoted

It should not go upstream nor into debian.

There is no reason it cannot be implemented as a build option in the
upstream package. Then you can get rid of all your nasty hacks and
simply add --enable-cf-protections to your distro's configure
options.

And other distros that also support all this functionality can use
it to. Please play nice with others and do things the right way
instead of making silly claims about how "nobody else can use this"
when it's clear that they can if they also tick all the necessary
boxes.

debian will probably will not want --enable-cf-protections as a
configure option, and will enable CET via dpkg-buildflags as a
hardening option, which will then be turned on by default for relevant
architectures and series as of when debian kernel starts to support
it.

as that way, debian will be able to affect that change across the whole distro.

once CET is actually merged into kernel, I do not expect configure
options or debian/rules changes to enable CET. At most `export
DEB_BUILD_MAINT_OPTIONS=hardening` should be enough in debian/rules.

-- 
Regards,

Dimitri.