The built librsvg-2.so library from gnome-base/librsvg-2.58.5 lacks CET/shadow stack markings: > $ readelf -n /usr/lib64/librsvg-2.so | grep -a SHSTK > (empty) It looks like Rust 1.60+ has an appropriate option to enable such markings: https://github.com/rust-lang/rust/blob/master/src/doc/unstable-book/src/compiler-flags/cf-protection.md Maybe a "cet" USE flag should be added to dev-lang/rust ebuild to enable it by default, much like "cet" USE flag does such for sys-devel/gcc? I have previously reported this upstream, but upstream closed the issue responding that the build flags "are generally overridden by those who distribute the binary": https://gitlab.gnome.org/GNOME/librsvg/-/issues/1151#note_2343581
FWIW, I build with > RUSTFLAGS="... -Z cf-protection=full" and I have > $ readelf -n /usr/lib64/librsvg-2.so | grep -a SHSTK > Properties: x86 feature: IBT, SHSTK The problem is that the `-Z cf-protection=...` flag is only available available in rust if USE=nightly is set.
