1 # Basic kernel hardening options (specific to arm64)
3 # Make sure PAN emulation is enabled.
4 CONFIG_ARM64_SW_TTBR0_PAN=y
6 # Software Shadow Stack or PAC
7 CONFIG_SHADOW_CALL_STACK=y
9 # Pointer authentication (ARMv8.3 and later). If hardware actually supports
10 # it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
11 CONFIG_ARM64_PTR_AUTH=y
12 CONFIG_ARM64_PTR_AUTH_KERNEL=y
14 # Available in ARMv8.5 and later.
16 CONFIG_ARM64_BTI_KERNEL=y
18 CONFIG_KASAN_HW_TAGS=y
21 # Available in ARMv8.7 and later.