| # Basic kernel hardening options (specific to arm64) | |
| # Make sure PAN emulation is enabled. | |
| CONFIG_ARM64_SW_TTBR0_PAN=y | |
| # Software Shadow Stack or PAC | |
| CONFIG_SHADOW_CALL_STACK=y | |
| CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y | |
| # Pointer authentication (ARMv8.3 and later). If hardware actually supports | |
| # it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled. | |
| CONFIG_ARM64_PTR_AUTH=y | |
| CONFIG_ARM64_PTR_AUTH_KERNEL=y | |
| # Available in ARMv8.5 and later. | |
| CONFIG_ARM64_BTI=y | |
| CONFIG_ARM64_BTI_KERNEL=y | |
| CONFIG_ARM64_MTE=y | |
| CONFIG_KASAN_HW_TAGS=y | |
| CONFIG_ARM64_E0PD=y | |
| # Available in ARMv8.7 and later. | |
| CONFIG_ARM64_EPAN=y |