diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 11:08:53 -0400 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 11:09:39 -0400 |
| commit | 214f5f3d2bd389e468bc42ee6a419ab356315d97 (patch) | |
| tree | d792217223ee92f6882620d02f6eb91878804848 /static/features.html | |
| parent | bd1b44724d3a1c2d40d1ed6d5c1dc06bdaa7ad61 (diff) | |
explicitly list userspace compiler hardening flags
Most of these features are now done upstream other than enabling PAC,
BTI and making signed integer overflow well-defined when overflow
checking isn't enabled. There are other things which could be considered
to be part of this set of features but are covered elsewhere already.
Diffstat (limited to 'static/features.html')
| -rw-r--r-- | static/features.html | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/static/features.html b/static/features.html index 5547b082..99ba60a2 100644 --- a/static/features.html +++ b/static/features.html @@ -305,7 +305,11 @@ been reused once and gone through the quarantines twice</li> </ul> </li> - <li>Hardened compiler toolchain</li> + <li>On ARMv9, Branch Target Identification (BTI) and Pointer + Authentication Code (PAC) return address protection are enabled for + userspace OS code we build instead of only specific apps</li> + <li>Signed integer overflow is made well defined in C and C++ for code + where automatic overflow checking is disabled</li> <li> Hardened kernel <ul> |