1# Basic kernel hardening options (specific to arm64) 2 3# Make sure PAN emulation is enabled. 4CONFIG_ARM64_SW_TTBR0_PAN=y 5 6# Software Shadow Stack or PAC 7CONFIG_SHADOW_CALL_STACK=y 8CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y 9 10# Pointer authentication (ARMv8.3 and later). If hardware actually supports 11# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled. 12CONFIG_ARM64_PTR_AUTH=y 13CONFIG_ARM64_PTR_AUTH_KERNEL=y 14 15# Available in ARMv8.5 and later. 16CONFIG_ARM64_BTI=y 17CONFIG_ARM64_BTI_KERNEL=y 18CONFIG_ARM64_MTE=y 19CONFIG_KASAN_HW_TAGS=y 20CONFIG_ARM64_E0PD=y 21 22# Available in ARMv8.7 and later. 23CONFIG_ARM64_EPAN=y 24