Linux 6.11 Hardening Makes FineIBT Default Configurable At Build Time

Kees Cook submitted all of the hardening updates this week for the Linux 6.11 merge window in beefing up the kernel's defenses against various attack vectors and vulnerabilities.

The hardening updates for Linux 6.11 are mostly minor with a handful of random alterations. One item worth mentioning though is the FineIBT mode being Kconfig-selectable at build-time. FineIBT was merged back in 2022 as an alternative Control Flow Integrity (CFI) implementation. FineIBT is a software and hardware hybrid scheme with Indirect Branch Tracking (IBT).

While the Linux kernel will use FineIBT by default if there is the IBT support of the processor, it can be overrode by using the "cfi=kcfi" boot parameter to force kCFI use by default rather than FineIBT. There's been an expressed desire though to allow setting the CFI default method at build-time via Kconfig. With Linux 6.11 such a Kconfig knob has arrived with the "CONFIG_CFI_AUTO_DEFAULT" build switch.

Kees Cook explained in the patch adding the new CFI_AUTO_DEFAULT Kconfig option:

"Since FineIBT performs checking at the destination, it is weaker against attacks that can construct arbitrary executable memory contents. As such, some system builders want to run with FineIBT disabled by default. Allow the "cfi=kcfi" boot param mode to be selectable through Kconfig via the newly introduced CONFIG_CFI_AUTO_DEFAULT."

That ability landed in Linux 6.11 Git this week via the hardening pull request.