arch/arm64/configs/hardening.config

   1 # Basic kernel hardening options (specific to arm64)
   2
   3 # Make sure PAN emulation is enabled.
   4 CONFIG_ARM64_SW_TTBR0_PAN=y
   5
   6 # Software Shadow Stack or PAC
   7 CONFIG_SHADOW_CALL_STACK=y
   8 CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y
   9
  10 # Pointer authentication (ARMv8.3 and later). If hardware actually supports
  11 # it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
  12 CONFIG_ARM64_PTR_AUTH=y
  13 CONFIG_ARM64_PTR_AUTH_KERNEL=y
  14
  15 # Available in ARMv8.5 and later.
  16 CONFIG_ARM64_BTI=y
  17 CONFIG_ARM64_BTI_KERNEL=y
  18 CONFIG_ARM64_MTE=y
  19 CONFIG_KASAN_HW_TAGS=y
  20 CONFIG_ARM64_E0PD=y
  21
  22 # Available in ARMv8.7 and later.
  23 CONFIG_ARM64_EPAN=y