From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 1/2] make.sh: x86_64: Enable CET full Date: Tue, 11 Jul 2023 13:27:18 +0000 Message-ID: <20230711132719.785979-1-michael.tremer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8237022836227046701==" List-Id: --===============8237022836227046701== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit -fcf-protection enables Indirect Branch Tracking, which we have recently enabled in the kernel. We should enable this in userspace, too. I could not find out what GCC defaults to without any value, so this patch is explicitely enabling IBT for function returns, indirect function calls and indirect jumps. Signed-off-by: Michael Tremer --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index 57b6c6f15..f07604073 100755 --- a/make.sh +++ b/make.sh @@ -145,7 +145,7 @@ configure_build() { BUILDTARGET="${build_arch}-pc-linux-gnu" CROSSTARGET="${build_arch}-cross-linux-gnu" BUILD_PLATFORM="x86" - CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection" + CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection=full" ;; aarch64) -- 2.39.2 --===============8237022836227046701==--