Compiler Hardening Guide should include -fcf-protection

[thomasnyman]

Brought up during the C/C++ Compiler BP Call 2023-09.27.

The -fcf-protection=[full|branch|return|none|check] enables the instrumentation of control-flow transfers to ensure that target addresses of indirect control-flow transfer instructions (such as indirect function calls, function returns, and indirect jumps) are within a statically or dynamically determined set of possible targets. This is intended to protect against threats as Return-oriented Programming (ROP), and similarly call/jmp-oriented programming (COP/JOP).

This flag is supported since GCC 8.0 and Clang 7.0.0.

Considerations and references

• GCC documentation
• Currently only supports x86 processors with Intel Control-Flow Enforcement (CET) or AMD Shadow Stack hardware features
• Kernel support for userspace x86 shadow stack added in Linux 6.6
• Requires glibc 2.28 or later
• Potential ABI compatibility issues in applications that manage their stacks in ways which do not conform with shadow stack expections

[siddhesh]

It could go into an architecture-specific flags section. There's also -mbranch-protection=none|standard|pac-ret[+leaf +b-key]|bti for aarch64.

[thesamesam]

See also #267.

[thomasnyman]

Fixed by #260.