Defending the Branch: PAC, BTI & GCS on Linux
summary
ARM AArch64 defenses are deployable now but require concrete changes: PAC signs LR using A/B keys and must be encoded in DWARF/CFI so unwinding can demangle and verify, BTI landing pads must appear in every object file (or the linker will clear the bit), and GCS is a kernel-enabled shadow stack toggled via PRCTL and only activates if every ELF dependency is marked. Toolchain flags in GCC/Clang and GNU note sections (example: OpenSSL header) make binaries backward compatible via hint-space; common failures come from hand-written assembly, missing CIE/FDE metadata, and exception-runtime key handling. Testing is done on simulators/emulators.
AI-written summary · about
chapters (13)
- 0:00ARM security features intro
- 1:24BTI and gadget mitigation
- 2:49PAC and GCS hardware support
- 5:00Enabling PAC BTI GCS in Linux
- 10:16BTI and PAC code analysis
- 16:24DWARF and CFI for security
- 25:00PAC in libffi exceptions
- 28:11Branch protection compiler flags
- 31:00ARM branch types and state
- 33:26Guarded control stack
- 36:58LLVM and runtime support
- 37:44Future Linux security features
- 38:48Q&A and SELinux plans
related talks
54mSecurity Features status update
38mTaking Kernel Hardening to the Next Level
52mIntra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
01h 34mA Little Introduction to Control Flow Integrity in C++
44mWhere are we on security features?
24mGuarded Control Stack on arm64: Challenges in Enabling Shadow Stack Support...
01h 46mA little Introduction to Control Flow Integrity
21mSecurity Features status update