From 5bd823ab022b1c685d897ad12fad4e7dd8d24860 Mon Sep 17 00:00:00 2001
From: alexvojproc <16513623+alexvojproc@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:50:01 +0100
Subject: [PATCH] feat: enable KCFI with clang

---
 copr_script.sh                 | 14 ++++++++++++++
 patches/build-with-clang.patch | 13 +++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 patches/build-with-clang.patch

diff --git a/copr_script.sh b/copr_script.sh
index cb970ec..0daa618 100644
--- a/copr_script.sh
+++ b/copr_script.sh
@@ -26,9 +26,23 @@ configs_to_enable=(
   # https://www.kernelconfig.io/CONFIG_PROC_PAGE_MONITOR
   # requires a value set since its parent gets disabled
   CONFIG_PROC_PAGE_MONITOR
+
+  # Enable control flow integrity.
+  CONFIG_CFI
+
+  # Normalizes the CFI tags for integer types across C and Rust.
+  # Needs to be enabled as Fedora sets CONFIG_RUST=y.
+  CONFIG_CFI_ICALL_NORMALIZE_INTEGERS
 )
 
 configs_to_disable=(
+  # Do not use FineIBT by default; use KCFI instead. Same as the cfi=kcfi karg.
+  # FineIBT has had a history of vulnerabilities and KCFI is more robust.
+  CONFIG_CFI_AUTO_DEFAULT
+
+  # Panic on CFI violations, as permissive mode is for development use only.
+  CONFIG_CFI_PERMISSIVE
+
   # https://www.kernelconfig.io/CONFIG_INFINIBAND
   # https://en.wikipedia.org/wiki/InfiniBand
   # InfiniBand support
diff --git a/patches/build-with-clang.patch b/patches/build-with-clang.patch
new file mode 100644
index 0000000..147a2b6
--- /dev/null
+++ b/patches/build-with-clang.patch
@@ -0,0 +1,13 @@
+diff --git a/kernel.spec b/kernel.spec
+index 2e03403..b31f680 100644
+--- a/kernel.spec
++++ b/kernel.spec
+@@ -13,7 +13,7 @@
+ %global _lto_cflags %{nil}
+
+ # Option to enable compiling with clang instead of gcc.
+-%bcond_with toolchain_clang
++%bcond_without toolchain_clang
+
+ %if %{with toolchain_clang}
+ %global toolchain clang