Implement `-Z allow-partial-mitigations` (RFC 3855) #149357

arielb1 · 2025-11-26T18:50:38Z

This implements -Z allow-partial-mitigations as an unstable option, currently with support for control-flow-guard and stack-protector.

As a difference from the RFC, we have -Z allow-partial-mitigations=!foo rather than -Z deny-partial-mitigations=foo, since I couldn't find an easy way to have an allow/deny pair of flags where the latter flag wins.

To allow for stabilization, this is only enabled starting from the next edition. Maybe a better policy is possible (bikeshed).

r? @rcvalle

rustbot · 2025-11-26T18:50:41Z

These commits modify compiler targets.
(See the Target Tier Policy.)

Urgau · 2025-11-26T19:52:21Z

compiler/rustc_metadata/messages.ftl


+metadata_mitigation_less_strict_in_dependency =
+    your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`
+    .note = Recompile that crate with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled


Diagnostics must always start with a lowercase letter.

Suggested change

.note = Recompile that crate with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled

.note = recompile that `{$extern_crate}` with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled

Urgau · 2025-11-26T19:52:46Z

compiler/rustc_metadata/messages.ftl

+metadata_mitigation_less_strict_in_dependency =
+    your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`
+    .note = Recompile that crate with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled
+    .help = It is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z allow-partial-mitigations=!{$mitigation_name}`


Suggested change

.help = It is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z allow-partial-mitigations=!{$mitigation_name}`

.help = it is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z allow-partial-mitigations=!{$mitigation_name}`

Urgau · 2025-11-26T19:54:52Z

To allow for stabilization, this is only enabled starting from the next edition. Maybe a better policy is possible (bikeshed).

I don't think we currently have any command line arguments who is edition depended, that would be a first.

arielb1 · 2025-11-26T19:59:19Z

I don't think we currently have any command line arguments who is edition depended, that would be a first.

The behavior for -C control-flow-guard is in the RFC. Tho that RFC is not approved yet.

I do think we want to eventually make -C control-flow-guard enforcing, and I think we have to do that across an edition boundary.

teor2345 · 2025-11-26T21:49:14Z

compiler/rustc_session/src/options.rs

+            Some(s) => {
+                for sub in s.split(',') {
+                    let (sub, enabled) =
+                        if sub.starts_with('!') { (&sub[1..], false) } else { (sub, true) };


Using ! for negation on the command-line is non-standard. It might also cause shell command parsing issues, because ! is a history search and insert metacharacter in some common shells.

The standard CLI negation prefix is no-, I suggest we use that instead.

The dev guide says to avoid no- for boolean flags, but I don't think that applies to more complex options:

rust/src/doc/rustc-dev-guide/src/cli.md

Lines 15 to 16 in 1be6b13

- Avoid flags with the `no-` prefix. Instead, use the [`parse_bool`] function,

such as `-C embed-bitcode=no`.

I basically put ! as a placeholder. Let's wait with it for a little bit of time until we figure out what to do.

I'd suggest further investigating the possibility of using -Z deny-partial-mitigations=foo instead as described in the RFC.

rcvalle · 2025-12-05T22:08:22Z

compiler/rustc_metadata/messages.ftl

    could not find native static library `{$libname}`, perhaps an -L flag is missing?

+metadata_mitigation_less_strict_in_dependency =
+    your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`


Suggested change

your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`

your program uses the crate `{$extern_crate}`, that is not compiled with `{$mitigation_name}{$mitigation_level}` enabled

rcvalle · 2025-12-05T22:09:36Z

compiler/rustc_metadata/messages.ftl


+metadata_mitigation_less_strict_in_dependency =
+    your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`
+    .note = recompile `{$extern_crate}` with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled


Suggested change

.note = recompile `{$extern_crate}` with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled

.note = recompile `{$extern_crate}` with `{$mitigation_name}{$mitigation_level}` enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an executable file that has the mitigation only partially enabled

rcvalle · 2025-12-05T22:15:01Z

compiler/rustc_metadata/src/rmeta/decoder.rs

 pub(crate) type TargetModifiers = Vec<TargetModifier>;

+/// Enforced Mitigations
+pub(crate) type EnforcedMitigations = Vec<EnforcedMitigation>;


Would it be easier to have a list of allowed partial mitigations instead (with all mitigations being enforced by default)?

Would it be easier to have a list of allowed partial mitigations instead (with all mitigations being enforced by default)?

An "enforced mitigation" is (to me) the name of a mitigation that is enforced according to RFC 3855. Maybe we should call it "EnforcableMitigation"?

In metadata, you need to have the list of enforced mitigations that the dependency crate has enabled.

What I'm wondering isn't about the naming itself but about a safer default (i.e., all mitigations enforced by default) so we would have an allowlist of mitigations that could be applied partially.

What I'm wondering isn't about the naming itself but about a safer default (i.e., all mitigations enforced by default) so we would have an allowlist of mitigations that could be applied partially.

You have to define something as a "mitigation". The way you do it is by putting it in the "enforcable mitigation" list.

There is no programmatic list of "mitigations" other than the enforcable mitigation list

How about something more descriptive like DeniedPartialMitigations? Then you could either have an AllowedPartialMitigations or remove a mitigation from this list when --deny-partial-mitigations is used.

Alternatively, you could have a main Mitigations list defined somewhere in the compiler (or a way to mark an option as a mitigation), and just use an AllowedPartialMitigations list.

EnforcedMitigations is the list of enforced mitigations that are enabled for a crate

if an enforced mitigation is enabled on a crate, and not enabled on a dependency, and is not explicitly "-C allow-partial-mitigation"-d, this causes an error

The "enforced_mitigations! {" list contains the main source of what is considered an "enforced mitigation"

I am not sure it should be tied to flags directly, because you can have stuff like e.g. having both -C stack-protector and -Z stack-protector being the same mitigation

rustbot · 2025-12-05T22:19:31Z

Reminder, once the PR becomes ready for a review, use @rustbot ready.

arielb1 · 2025-12-10T19:09:25Z

Found a way to make -Z deny-partial-mitigations=foo work

@rustbot ready

This implements `-Z allow-partial-mitigations` as an unstable option, currently with support for control-flow-guard and stack-protector. As a difference from the RFC, we have `-Z allow-partial-mitigations=!foo` rather than `-Z deny-partial-mitigations=foo`, since I couldn't find an easy way to have an allow/deny pair of flags where the latter flag wins. To allow for stabilization, this is only enabled starting from the next edition. Maybe a better policy is possible (bikeshed).

…ns=!

rustbot · 2025-12-10T21:48:34Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

arielb1 · 2025-12-10T21:49:12Z

Addressed rebase problems

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Nov 26, 2025

rustbot assigned rcvalle Nov 26, 2025

arielb1 mentioned this pull request Nov 26, 2025

Mitigation enforcement rust-lang/rfcs#3855

Open

This comment has been minimized.

Sign in to view

ojeda mentioned this pull request Nov 26, 2025

rustc wanted features & bugfixes Rust-for-Linux/linux#355

Open

63 tasks

arielb1 force-pushed the enforce-partial-mitigations branch from b34534b to 1fefdbe Compare November 26, 2025 19:28

Urgau reviewed Nov 26, 2025

View reviewed changes

teor2345 reviewed Nov 26, 2025

View reviewed changes

arielb1 force-pushed the enforce-partial-mitigations branch 2 times, most recently from 2f2a134 to 99913dd Compare November 27, 2025 16:09

This comment has been minimized.

Sign in to view

rcvalle added the PG-exploit-mitigations Project group: Exploit mitigations label Dec 5, 2025

rcvalle requested changes Dec 5, 2025

View reviewed changes

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Dec 5, 2025

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Dec 10, 2025

arielb1 force-pushed the enforce-partial-mitigations branch from 2fabf16 to e561031 Compare December 10, 2025 19:13

This comment has been minimized.

Sign in to view

arielb1 force-pushed the enforce-partial-mitigations branch from e561031 to 2c3f3b3 Compare December 10, 2025 20:24

This comment has been minimized.

Sign in to view

Ariel Ben-Yehuda added 3 commits December 10, 2025 21:18

address review comments

bd6432c

allow denying mitigations in earlier editions

830d813

Ariel Ben-Yehuda added 5 commits December 10, 2025 21:33

enforced => enforcable mitigation

8cdba69

improve error messages

b9d09b0

EnforcableMitigation => DeniedPartialMitigation

fc6f81c

use -Z deny-partial-mitigations instead of -Z allow-partial-mitigatio…

b833b59

…ns=!

enforcable -> enforceable

33012b6

arielb1 force-pushed the enforce-partial-mitigations branch from 2c3f3b3 to 33012b6 Compare December 10, 2025 21:48

	.note = Recompile that crate with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled
	.note = recompile that `{$extern_crate}` with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled

	.help = It is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z allow-partial-mitigations=!{$mitigation_name}`
	.help = it is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z allow-partial-mitigations=!{$mitigation_name}`

	- Avoid flags with the `no-` prefix. Instead, use the [`parse_bool`] function,
	such as `-C embed-bitcode=no`.

	your program uses the crate `{$extern_crate}`, that is not protected by `{$mitigation_name}{$mitigation_level}`
	your program uses the crate `{$extern_crate}`, that is not compiled with `{$mitigation_name}{$mitigation_level}` enabled

	.note = recompile `{$extern_crate}` with the mitigation enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation only partially enabled
	.note = recompile `{$extern_crate}` with `{$mitigation_name}{$mitigation_level}` enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an executable file that has the mitigation only partially enabled

Uh oh!

Implement -Z allow-partial-mitigations (RFC 3855) #149357

Are you sure you want to change the base?

Implement -Z allow-partial-mitigations (RFC 3855) #149357

Conversation

arielb1 commented Nov 26, 2025

Uh oh!

rustbot commented Nov 26, 2025

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Urgau commented Nov 26, 2025

Uh oh!

arielb1 commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teor2345 Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arielb1 Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rustbot commented Dec 5, 2025

Uh oh!

arielb1 commented Dec 10, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

rustbot commented Dec 10, 2025

Uh oh!

arielb1 commented Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Implement `-Z allow-partial-mitigations` (RFC 3855) #149357

Implement `-Z allow-partial-mitigations` (RFC 3855) #149357

arielb1 commented Nov 26, 2025 •

edited

Loading

teor2345 Nov 26, 2025 •

edited

Loading

arielb1 Dec 8, 2025 •

edited

Loading