diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 11:08:53 -0400 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 11:09:39 -0400 |
| commit | 214f5f3d2bd389e468bc42ee6a419ab356315d97 (patch) | |
| tree | d792217223ee92f6882620d02f6eb91878804848 | |
| parent | bd1b44724d3a1c2d40d1ed6d5c1dc06bdaa7ad61 (diff) | |
explicitly list userspace compiler hardening flags
Most of these features are now done upstream other than enabling PAC,
BTI and making signed integer overflow well-defined when overflow
checking isn't enabled. There are other things which could be considered
to be part of this set of features but are covered elsewhere already.
| -rw-r--r-- | static/features.html | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/static/features.html b/static/features.html index 5547b082..99ba60a2 100644 --- a/static/features.html +++ b/static/features.html @@ -305,7 +305,11 @@ been reused once and gone through the quarantines twice</li> </ul> </li> - <li>Hardened compiler toolchain</li> + <li>On ARMv9, Branch Target Identification (BTI) and Pointer + Authentication Code (PAC) return address protection are enabled for + userspace OS code we build instead of only specific apps</li> + <li>Signed integer overflow is made well defined in C and C++ for code + where automatic overflow checking is disabled</li> <li> Hardened kernel <ul> |