From: marcos@orca.pet 
  
 El 21/08/2025 a las 18:34, Simon McVittie escribi€€: 
 > On Thu, 21 Aug 2025 at 16:48:35 +0200, Marcos Del Sol Vives wrote: 
 >> Would it be acceptable to, rather than disable it entirely as previously 
 >> proposed, enable CET only when compiling for IA64 (amd64), but not for any 
 >> other architecture? 
 > 
 > I think you are mixing up IA64 (Intel Itanium), a non-x86 instruction set 
 from Intel, with amd64/x86_64 (also known as EM64T or Intel 64), a 64-bit 
 expansion of the x86 instruction set. They are not the same thing, even 
 though 
 x86 is also referred to 
 as IA32: you might reasonably expect that the 64-bit expansion/replacement 
 of 
 IA32 would be called IA64, but because of how Intel have chosen to name 
 their 
 products, that is not actually true. (I agree that this naming is extremely 
 confusing.) 
 > 
 > Typical 64-bit "PC" laptops/desktops/servers are x86_64 machines that can 
 (hopefully) run Debian's amd64 architecture, regardless of whether their CPU 
 was manufactured by Intel, AMD or someone else. 
 > 
 > If you want to get security-sensitive changes merged for the benefit of 
 these architectures, it will probably go better if you are clear about which 
 architecture you are talking about! 
 > 
 > (Another relevant source of confusion is that 32-bit x86 is not the same 
 thing as x32.) 
 > 
 > €€€€€€ smcv 
  
 Hey. 
  
 I was incorrectly referring with IA64 not to Itanium but to x86-64 aka AMD64 
 aka long mode, as IA32 is indeed x86. My bad! The x86 naming scheme is 
 indeed 
 a pretty convoluted one. 
  
 Anyhow, my point would be the same: maybe keep CET only for amd64, and 
 disable 
 it for the rest: 
  
 --- sudo-1.9.13p3.orig/m4/hardening.m4 
 +++ sudo-1.9.13p3/m4/hardening.m4 
 @@ -105,6 +105,8 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [ 
                 ]) 
             fi 
  
 +           if test X"$host_cpu" = X"x86_64"; then 
 + 
             # Check for control-flow transfer instrumentation (Intel CET). 
             AX_CHECK_COMPILE_FLAG([-fcf-protection], [ 
                 AX_CHECK_LINK_FLAG([-fcf-protection], [ 
 @@ -112,6 +114,8 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [ 
                     AX_APPEND_FLAG([-Wc,-fcf-protection], 
 [HARDENING_LDFLAGS]) 
                 ]) 
             ]) 
 + 
 +           fi 
         fi 
  
         # Linker-specific hardening flags. 
  
 Marcos 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)