I am a glibc and Fedora contributor and on the team of glibc package maintainers in Fedora. We are working on enabling Shadow Stack support at runtime on Fedora ( Changes/ShadowStack - Fedora Project Wiki ). Once complete, the change would mean that Fedora enforces Shadow Stack protection at runtime for applications that support it.
I just filed a cpython issue for enabling the same on cpython. The proposal is to add -fcf-protection=return (shstk-only, no IBT) to cpython’s BASECFLAGS in configure.ac for the x86_64-linux-gnu platform triplet so that the interpreter, stdlib, and third-party extensions built against it are compiled with Shadow Stack support: Add x86_64 Shadow Stack support for Linux · Issue #154820 · python/cpython · GitHub
Both Fedora (since Fedora 28, 2018) and Ubuntu (since 24.04 if I understand correctly) already build their distributions with CET support (i.e. shadow-stack, and Indirect Branch Tracking). Enabling shadow-stack support in cpython will:
- Improve compatibility in the ecosystem by allowing distributions to run applications that depend on third-party python extensions (which inherit CFLAGS from here) in shadow-stack protection mode.
- Come at no compatibility cost since compatible binaries can run on machines that do not support SHSTK or distributions that do not enable it at runtime with practically no performance cost.
The benefit for Fedora is that as we work through transitioning to shadow-stack support enabled by default, third-party extensions will be compatible with Fedora’s runtime.
Some more context:
Shadow Stacks are a hardware-enforced security feature that maintains a separate, tamper proof list of return addresses to protect against Return-Oriented Programming style exploits. Shadow Stack hardware support is available on Intel 11th Generation and newer CPUs, and AMD Zen3 and newer CPUs. It is supported by both GCC (8.1+) and LLVM (7.0.0+) since 2018.