From: Michael Tremer <michael.tremer@ipfire.org>
Date: Tue, 11 Jul 2023 13:27:18 +0000 (+0000)
Subject: make.sh: x86_64: Enable CET full
X-Git-Tag: v2.27-core179~9^2~141
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9ea072e6272b7df7ec604a6799d27ed316e7d740;p=ipfire-2.x.git

make.sh: x86_64: Enable CET full

-fcf-protection enables Indirect Branch Tracking, which we have recently
enabled in the kernel. We should enable this in userspace, too.

I could not find out what GCC defaults to without any value, so this
patch is explicitely enabling IBT for function returns, indirect
function calls and indirect jumps.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/make.sh b/make.sh
index 21433aeb8e..1d357fb5a3 100755
--- a/make.sh
+++ b/make.sh
@@ -145,7 +145,7 @@ configure_build() {
 			BUILDTARGET="${build_arch}-pc-linux-gnu"
 			CROSSTARGET="${build_arch}-cross-linux-gnu"
 			BUILD_PLATFORM="x86"
-			CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection"
+			CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection=full"
 			;;
 
 		aarch64)