x86/alternatives: Make FineIBT mode Kconfig selectable

Browse source

Since FineIBT performs checking at the destination, it is weaker against
attacks that can construct arbitrary executable memory contents. As such,
some system builders want to run with FineIBT disabled by default. Allow
the "cfi=kcfi" boot param mode to be selectable through Kconfig via the
newly introduced CONFIG_CFI_AUTO_DEFAULT.

Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20240501000218.work.998-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>

...

This commit is contained in:

Kees Cook 2024-04-30 17:02:22 -07:00 • committed by Kees Cook

parent 51005a59bc

commit d6f635bcac

3 changed files with 14 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

arch/x86/Kconfig

View file

2

arch/x86/include/asm/cfi.h

View file

8

arch/x86/kernel/alternative.c

View file