Bug 949403

Summary:	gnome-base/librsvg-2.58.5: librsvg-2.so library incompatible with x86_64 CET/shadow stack
Product:	Gentoo Linux	Reporter:	Maciej S. Szmigiero <mail>
Component:	Current packages	Assignee:	Gentoo Linux Gnome Desktop Team <gnome>
Status:	UNCONFIRMED ---
Severity:	normal	CC:	mattst88, rust
Priority:	Normal
Version:	unspecified
Hardware:	AMD64
OS:	Linux
See Also:	https://gitlab.gnome.org/GNOME/librsvg/-/issues/1151 https://github.com/rust-lang/rust/issues/93754
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	949404

Description Maciej S. Szmigiero 2025-02-07 21:17:31 UTC

The built librsvg-2.so library from gnome-base/librsvg-2.58.5 lacks CET/shadow stack markings:
> $ readelf -n /usr/lib64/librsvg-2.so | grep -a SHSTK
> (empty)
It looks like Rust 1.60+ has an appropriate option to enable such markings:
https://github.com/rust-lang/rust/blob/master/src/doc/unstable-book/src/compiler-flags/cf-protection.md

Maybe a "cet" USE flag should be added to dev-lang/rust ebuild to enable it by default, much like "cet" USE flag does such for sys-devel/gcc?

I have previously reported this upstream, but upstream closed the issue responding that the build flags "are generally overridden by those who distribute the binary":
https://gitlab.gnome.org/GNOME/librsvg/-/issues/1151#note_2343581

Comment 1 Matt Turner gentoo-dev

2025-02-17 20:03:34 UTC

FWIW, I build with

> RUSTFLAGS="... -Z cf-protection=full"

and I have

> $ readelf -n /usr/lib64/librsvg-2.so | grep -a SHSTK
>      Properties: x86 feature: IBT, SHSTK

The problem is that the `-Z cf-protection=...` flag is only available available in rust if USE=nightly is set.