Speakers
Justin Stitt
(Google)
Kees Cook
(Google)
Description
Another year of work is behind us, with lots of progress across GCC, Clang, and Rust to provide the Linux kernel with a variety of security features. Let's review and discuss where we are with parity between toolchains, approaches to solving open problems, and exploring new features.
Parity reached since last year:
- Various little behavioral corner-case bug fixes
In progress:
- Overflow Behavior Types (needed in GCC)
- forward-edge CFI (GCC KCFI at v14)
- coverage-sanitizer stack-depth tracking (needed in GCC)
Stalled / needs attention:
- -fbounds-safety language extension (slow in Clang)
- __strong typedef (needs design finalized)
- Link Time Optimization for GCC kernel support
- backward-edge CFI (x86 CET shadow stack, kernel mode)
Author
Kees Cook
(Google)
Co-author
Justin Stitt
(Google)