diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-07-16 13:45:43 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-07-16 13:45:43 -0700 |
| commit | ce5a51bfacf7a2953f8fa309a8fc8540c2e288da (patch) | |
| tree | c14afaeac549e50eedff24b1f9dce1d06b390cc7 /arch/x86/Kconfig | |
| parent | 8050258bd1eed0f77dd7e3fa15feb23bbcc38e63 (diff) | |
| parent | 872bb37f6829d4f7f3ed5afe2786add3d4384b4b (diff) | |
| download | linux-ce5a51bfacf7a2953f8fa309a8fc8540c2e288da.tar.gz linux-ce5a51bfacf7a2953f8fa309a8fc8540c2e288da.tar.bz2 linux-ce5a51bfacf7a2953f8fa309a8fc8540c2e288da.zip | |
Merge tag 'hardening-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- lkdtm/bugs: add test for hung smp_call_function_single() (Mark
Rutland)
- gcc-plugins: Remove duplicate included header file stringpool.h
(Thorsten Blum)
- ARM: Remove address checking for MMUless devices (Yanjun Yang)
- randomize_kstack: Clean up per-arch entropy and codegen
- KCFI: Make FineIBT mode Kconfig selectable
- fortify: Do not special-case 0-sized destinations
* tag 'hardening-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
randomize_kstack: Improve stack alignment codegen
ARM: Remove address checking for MMUless devices
gcc-plugins: Remove duplicate included header file stringpool.h
randomize_kstack: Remove non-functional per-arch entropy filtering
fortify: Do not special-case 0-sized destinations
x86/alternatives: Make FineIBT mode Kconfig selectable
lkdtm/bugs: add test for hung smp_call_function_single()
Diffstat (limited to 'arch/x86/Kconfig')
| -rw-r--r-- | arch/x86/Kconfig | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 9778234cf111..7cd41bbaf875 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2414,6 +2414,15 @@ config STRICT_SIGALTSTACK_SIZE Say 'N' unless you want to really enforce this check. +config CFI_AUTO_DEFAULT + bool "Attempt to use FineIBT by default at boot time" + depends on FINEIBT + default y + help + Attempt to use FineIBT by default at boot time. If enabled, + this is the same as booting with "cfi=auto". If disabled, + this is the same as booting with "cfi=kcfi". + source "kernel/livepatch/Kconfig" endmenu |