Linux 6.10's Hardening Configuration Now Enables KCFI & Other Features

Introduced last year with the Linux 6.7 kernel was a hardening configuration to allow for "make hardening.config" as an easy way of building a security-hardened Linux kernel with sane defaults. With Linux 6.10 there are some additional security minded features now enabled.

Most notably, the Linux 6.10 hardening configuration now enables the Clang Kernel Control Flow Integrity (KCFI) protections. This only works if using LLVM Clang rather than GCC as the compiler for building the kernel.

The hardening updates for Linux 6.6 also include enabling CONFIG_UNWIND_PATCH_PAC_INTO_SCS to enable the shadow call stack dynamically using code patching. CONFIG_X86_KERNEL_IBT is also enabled for the Control-flow Enforcement Technology (CET) Indirect Branch Tracking (IBT) functionality when running on newer processors. Plus the hardened kernel build now enables CONFIG_PAGE_TABLE_CHECK and CONFIG_PAGE_TABLE_CHECK_ENFORCED to enforce the page table checking by default.

There are also other kernel hardening updates that were sent in as part of the hardening pull request last week for Linux 6.10 and has since been merged.