4.2.1.22 The not-dynamic-tags test ¶

  Problem:  Protecting AArch64 binaries needs newer versions of AArch64 cores
  Fix By:   Compile with -mbranch-protection=off
  Waive If: Not running on AArch64
  Waive If: The application will run on Fedora 35 or later.
  Waive If: The application will not run on newer AArch64 cores.
  Waive If: The application does not expect to have branch protection.

  Example:  MAYB: not dynamic tags test because the BTI and PAC flags are present in the dynamic tags, but they are not supported by the OS
  Example:  MAYB: not dynamic tags test because the BTI_PLT flag is present in the dynamic tags, but it is not supported by the OS
  Example:  MAYB: not dynamic tags test because the PAC_PLT flag is present in the dynamic tags, but it is not supported by the OS

Note - this test is the inverse of the The dynamic-tags test test and directly related to the The not-branch-protection test test.

This test checks to see if executable AArch64 binaries have been marked as supporting the BTI and PAC security features. Such features require the support of the run-time loader in order to work, and this test is intended for environments where this support is missing. (Such as RHEL or pre version-35 Fedora). Note - a binary that requests the BTI and PAC features will still work on older hardware, it just will not have the requested protections.

The security features can be disabled by compiling with the -mbranch-protection=none gcc command line option.

Note - this test is automatically disabled if one of the following profile options is used:

--profile=rawhide

--profile=f44

--profile=f43

--profile=f42

--profile=f41

--profile=f40

--profile=f39

--profile=f38

--profile=f37

--profile=f36

--profile=el10

The test is automatically enabled if one of the other profile options is used, ie:

--profile=el7

--profile=el8

--profile=el9

--profile=f35

If necessary the test can be disabled via the --skip-not-dynamic-tags option and re-enabled via the --test-not-dynamic-tags option.