Where are we on security features?
summary
The update reports concrete compiler and kernel work: compilers and kernel reach parity on zeroing call-used registers and on structure-layout randomization; clang ships a new forward-edge CFI implementation while GCC still needs to add the feature; shadow-call-stack software support exists for arm64/x86; GCC patches for strict flexible arrays level 3 land in review (set 1 submitted, sets 2–3 planned) to fix built-in object-size/fortify checks and warnings; the kernel still produces ~60,000 zero-length-array warnings.
AI-written summary · about
chapters (16)
- 0:00Introduction to security features
- 1:03Stack protector and register zeroing
- 3:57Stack protector guard location
- 4:43Forward Edge CFI progress
- 6:30Backward Edge CFI and Shadow Stack
- 7:35Strict Flexible Arrays overview
- 12:00Flexible array levels and warnings
- 20:25Compiler encouragement for standard code
- 24:44Current status and GCC patches
- 28:48Clang differences and zero-length arrays
- 31:21Future work and kernel improvements
- 33:08Fixed size array annotations
- 35:58Bounded flexible arrays and fat pointers
- 37:45Overflow protection and exceptions
- 41:43Arithmetic overflow handling
- 42:51Type introspection and assignments
related talks
54mSecurity Features status update
21mSecurity Features status update
58mKeynote: Safety and Security: The Future of C and C++
34mMaking C Less Dangerous
35mUpstream Kernel Hardening: Recent Progress and Challenges
18mExciting new compiler flags for kernel security
39mControl Flow Integrity in the Linux Kernel
52mKernel Hardening: Ten Years Deep