github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1752] spectre #1187

New issue

Closed

opened 2026-05-05 07:37:28 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 07:37:28 -06:00

Owner

Originally created by @HotelBellaMuerte on GitHub (Jan 26, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1752

does firejail need be rebuild with antispectre flags

Originally created by @HotelBellaMuerte on GitHub (Jan 26, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1752 does firejail need be rebuild with antispectre flags

gitea-mirror

2026-05-05 07:37:28 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:37:33 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 27, 2018):

What flags do we need to add?

@netblue30 commented on GitHub (Jan 27, 2018): What flags do we need to add?

gitea-mirror commented

2026-05-05 07:37:35 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Jan 27, 2018):

@netblue30 I think @bn0785ac is referencing the GCC retpoline patches (each different links), they seem to have been merged into GCC 7.3 and add a new -mindirect-branch={keep/thunk/thunk-inline/thunk-extern} flag. It mitigates against Spectre variant 2.

Add -mindirect-branch= option to convert indirect call and jump to call
and return thunks. The default is 'keep', which keeps indirect call and
jump unmodified. 'thunk' converts indirect call and jump to call and
return thunk. 'thunk-inline' converts indirect call and jump to inlined
call and return thunk. 'thunk-extern' converts indirect call and jump to
external call and return thunk provided in a separate object file. You
can control this behavior for a specific function by using the function
attribute indirect_branch.

@SkewedZeppelin commented on GitHub (Jan 27, 2018): @netblue30 I think @bn0785ac is referencing the GCC [retpoline](https://support.google.com/faqs/answer/7625886) [patches](https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c6b72be421ded17e0c156070ba6e90aa6c335ed6) (each different links), they seem to have been merged into GCC 7.3 and add a new `-mindirect-branch={keep/thunk/thunk-inline/thunk-extern}` flag. It mitigates against Spectre variant 2. > Add -mindirect-branch= option to convert indirect call and jump to call and return thunks. The default is 'keep', which keeps indirect call and jump unmodified. 'thunk' converts indirect call and jump to call and return thunk. 'thunk-inline' converts indirect call and jump to inlined call and return thunk. 'thunk-extern' converts indirect call and jump to external call and return thunk provided in a separate object file. You can control this behavior for a specific function by using the function attribute indirect_branch.

gitea-mirror commented

2026-05-05 07:37:36 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 24, 2018):

Added in e3f64f751e

@SkewedZeppelin commented on GitHub (Mar 24, 2018): Added in e3f64f751ec2caaf4c209f95eefab5bc9166db0e

gitea-mirror commented

2026-05-05 07:37:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 24, 2018):

Thanks @SkewedZeppelin - is there anything else besides -mindirect-branch? I'll try to play with llvm compiler (clang), I'm not sure if anybody is using it.

@netblue30 commented on GitHub (Mar 24, 2018): Thanks @SkewedZeppelin - is there anything else besides -mindirect-branch? I'll try to play with llvm compiler (clang), I'm not sure if anybody is using it.

gitea-mirror commented

2026-05-05 07:37:38 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Mar 25, 2018):

LLVM added a -mretpoline option detailed here https://reviews.llvm.org/D41723

@SkewedZeppelin commented on GitHub (Mar 25, 2018): LLVM added a `-mretpoline` option detailed here https://reviews.llvm.org/D41723

gitea-mirror commented

2026-05-05 07:37:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 27, 2018):

Thanks, I'll put the fix in for clang also.

@netblue30 commented on GitHub (Mar 27, 2018): Thanks, I'll put the fix in for clang also.

gitea-mirror commented

2026-05-05 07:37:40 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 28, 2018):

@netblue30 any reason this is still open?

@chiraag-nataraj commented on GitHub (Sep 28, 2018): @netblue30 any reason this is still open?

gitea-mirror commented

2026-05-05 07:37:41 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 19, 2019):

Closing because the main fix has already been put in.

@chiraag-nataraj commented on GitHub (May 19, 2019): Closing because the main fix has already been put in.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1187

No description provided.

Rows
Columns