> I'm not sure this feature is a good idea, as-is. This is an > inscrutable failure mode, significantly worse than SELinux-based > failures. There's no consistent logging of the failure since it > depends on the runtime environment and the application. > > I suspect the feature would just get globally turned off for Fedora to > be practically usable. This would probably go badly for RHEL too, > since it's much more common on RHEL to use software not built with the > standard hardening flags and signatures there.
If an application or even one of its dependencies is built without shstk support, the feature is transparently disabled when the program starts up. Of course the dlopen failure mode does exist. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
