linux-hardening - Re: [PATCH 5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANiq72mQsLqhpX29NP3Zm8HZ5m429tSXjgFcRYJM3e=Zac1G1w@mail.gmail.com>
Date: Mon, 25 Aug 2025 19:00:22 +0200
From: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
To: Kees Cook <kees@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>, Kees Cook <kees@...flux.net>, 
	Sami Tolvanen <samitolvanen@...gle.com>, Linus Walleij <linus.walleij@...aro.org>, 
	Mark Rutland <mark.rutland@....com>, Puranjay Mohan <puranjay@...nel.org>, 
	David Woodhouse <dwmw2@...radead.org>, Jonathan Corbet <corbet@....net>, 
	Nathan Chancellor <nathan@...nel.org>, x86@...nel.org, linux-doc@...r.kernel.org, 
	linux-kbuild@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
	linux-riscv@...ts.infradead.org, llvm@...ts.linux.dev, 
	linux-hardening@...r.kernel.org
Subject: Re: [PATCH 5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI

On Mon, Aug 25, 2025 at 5:35 PM Kees Cook <kees@...nel.org> wrote:
>
> Yeah, that's a good idea. What the right way to do that?
>
> config CFI_CLANG
>         bool "Use Clang's Control Flow Integrity (CFI)"
>         depends on ARCH_SUPPORTS_CFI
>         select CFI
>
> ?

I don't recall what is the idiomatic solution for renames, but I
remember Linus talking about this topic and about avoiding losing old
values if possible (perhaps getting a new question in `oldconfig` is
OK as long as the `olddefconfig` respects the old value).

I think your suggestion above will still make it appear twice in
`menuconfig` -- there may be a way to play with visibility to make it
better.

A simple possibility I can think of (assuming it works) is having the
CFI symbol for the time being introduced just as a `def_bool
CFI_CLANG` for a few releases so that people get the new one in their
configs.

Cheers,
Miguel