【cfi】 Do we need to turn on cfi for static libraries?

[yinchuang-code]

1、Do we need to open cfi for all static libraries that the shared library （which enable cfi）depends on?
2、If a static library has cfi turned on, do we need to turn on cfi for all shared libraries that contain it?

In our practice if we don't open cfi for the static library that the shared library （which enable cfi）depends on, we will have a cfi check failed, the cfi_check don't know the vtable which is exist in the static library

[asl]

I would suggest you to read https://clang.llvm.org/docs/ControlFlowIntegrityDesign.html

Long story short: CFI relies on the ability to see the "whole" binary. Cross-DSO CFI might be tricky.

[yinchuang-code]

I would suggest you to read https://clang.llvm.org/docs/ControlFlowIntegrityDesign.html
Long story short: CFI relies on the ability to see the "whole" binary. Cross-DSO CFI might be tricky.

---

Yes, i have read it.

1、Do we need to open cfi for all static libraries that the shared library （which enable cfi）depends on?
2、If a static library has cfi turned on, do we need to turn on cfi for all shared libraries that contain it?

---

1、 So the answer to these two questions is yes, right?
2、Is there any good way for us to get all the static libraries that dynamic libraries depend on?
3、Why don't we enable cfi in the compiler for all static libraries or enable cfi for whole binary when compiler found a library that has cfi enabled