mirror of
https://github.com/torvalds/linux.git
synced 2024-11-29 07:31:29 +00:00
a284e43852
Add some stuff that got missed along the way: - CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y so SCS vs PAC is hardware selectable. - CONFIG_X86_KERNEL_IBT=y while a default, just be sure. - CONFIG_CFI_CLANG=y globally. - CONFIG_PAGE_TABLE_CHECK=y for userspace mapping sanity. Reviewed-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20240501193709.make.982-kees@kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
24 lines
614 B
Plaintext
24 lines
614 B
Plaintext
# Basic kernel hardening options (specific to arm64)
|
|
|
|
# Make sure PAN emulation is enabled.
|
|
CONFIG_ARM64_SW_TTBR0_PAN=y
|
|
|
|
# Software Shadow Stack or PAC
|
|
CONFIG_SHADOW_CALL_STACK=y
|
|
CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y
|
|
|
|
# Pointer authentication (ARMv8.3 and later). If hardware actually supports
|
|
# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
|
|
CONFIG_ARM64_PTR_AUTH=y
|
|
CONFIG_ARM64_PTR_AUTH_KERNEL=y
|
|
|
|
# Available in ARMv8.5 and later.
|
|
CONFIG_ARM64_BTI=y
|
|
CONFIG_ARM64_BTI_KERNEL=y
|
|
CONFIG_ARM64_MTE=y
|
|
CONFIG_KASAN_HW_TAGS=y
|
|
CONFIG_ARM64_E0PD=y
|
|
|
|
# Available in ARMv8.7 and later.
|
|
CONFIG_ARM64_EPAN=y
|