On Wed, May 01, 2024 at 09:33:14AM -0700, Nathan Chancellor wrote: > On Tue, Apr 30, 2024 at 05:02:22PM -0700, Kees Cook wrote: > > Since FineIBT performs checking at the destination, it is weaker against > > attacks that can construct arbitrary executable memory contents. As such, > > some system builders want to run with FineIBT disabled by default. Allow > > the "cfi=kcfi" boot param mode to be selectable through Kconfig via the > > newly introduced CONFIG_CFI_AUTO_DEFAULT. > > > > Signed-off-by: Kees Cook <keesc...@chromium.org> > > I verified that flipping the configuration does indeed change the > default and that 'cfi=' could still be used to override whatever choice > was made at compile time. This patch was a perfect excuse to put my new > CET enabled test machine to work.
Heh, yeah. I have my one lonely CET system that is only powered on for this sort of testing too. ;) > > Reviewed-by: Nathan Chancellor <nat...@kernel.org> > Tested-by: Nathan Chancellor <nat...@kernel.org> Thanks! > CFI_DEFAULT_AUTO reads a little bit better to me personally but I am not > looking to get into painting today :) I went with CFI_AUTO_DEFAULT since this seems to be our current pattern for setting these kinds of boot param defaults. A selection of examples: arch/Kconfig:config RANDOMIZE_KSTACK_OFFSET_DEFAULT lib/Kconfig.debug:config CONSOLE_LOGLEVEL_DEFAULT mm/Kconfig.debug:config DEBUG_PAGEALLOC_ENABLE_DEFAULT -- Kees Cook
