Messages in this thread | | | Date | Tue, 30 Apr 2024 08:12:56 -0700 | From | Nathan Chancellor <> | Subject | Re: [PATCH] hardening: Refresh KCFI options, add some more |
| |
On Mon, Apr 29, 2024 at 10:35:03PM -0700, Kees Cook wrote: > On Mon, Apr 29, 2024 at 03:16:50PM -0700, Nathan Chancellor wrote: > > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote: > > [...] > > > +# Enable Kernel Control Flow Integrity (currently Clang only). > > > +CONFIG_CFI_CLANG=y > > > +# CONFIG_CFI_PERMISSIVE is not set > > > > Should this be a part of kernel/configs/hardening.config because RISC-V > > supports it (and 32-bit ARM will soon too)? > > Probably yes. I was worried it might be "noisy" for archs that don't > support it, but frankly if someone is using "make hardening.config" they > probably want to know about unsupported options. :)
It would be potentially noisy as it is currently written since someone building with GCC for arm64 or x86_64 could merge hardening.config into their configuration and they would see CONFIG_CFI_CLANG get enabled by merge_config.sh but on oldconfig or olddefconfig, it would get flipped off again because the toolchain dependencies are not met. Might as well make it architecture agnostic at that point :)
Cheers, Nathan
| |