Enable PAC and BTI hardware protections for aarch64

python3.14.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -361,6 +361,23 @@ Patch251: 00251-change-user-install-location.patch
 # This can be removed when Fedora 41 goes EOL (or updates setuptools).
 Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
 
+# 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6
+# Enable PAC and BTI protections for aarch64
+#
+# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
+#
+# The BTI flag must be applied in the assembler sources for this class
+# of attacks to be mitigated on newer aarch64 processors.
+#
+# Upstream PR: https://github.com/python/cpython/pull/130864/files
+#
+# The upstream patch is incomplete but only for the case where
+# frame pointers are not used on 3.13+.
+#
+# Since on Fedora we always compile with frame pointers the BTI/PAC
+# hardware protections can be enabled without losing Perf unwinding.
+Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1707,6 +1724,9 @@ CheckPython freethreading
 # ======================================================
 
 %changelog
+* Wed Jun 18 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.14.0~b3-2
+- Enable PAC and BTI hardware protections for aarch64
+
 * Tue Jun 17 2025 Miro Hrončok <mhroncok@redhat.com> - 3.14.0~b3-1
 - Update to Python 3.14.0b3
 - The .pyc magic number was bumped