feat: enable KCFI with clang

copr_script.sh

@@ -26,9 +26,23 @@ configs_to_enable=(
   # https://www.kernelconfig.io/CONFIG_PROC_PAGE_MONITOR
   # requires a value set since its parent gets disabled
   CONFIG_PROC_PAGE_MONITOR
+
+  # Enable control flow integrity.
+  CONFIG_CFI
+
+  # Normalizes the CFI tags for integer types across C and Rust.
+  # Needs to be enabled as Fedora sets CONFIG_RUST=y.
+  CONFIG_CFI_ICALL_NORMALIZE_INTEGERS
 )
 
 configs_to_disable=(
+  # Do not use FineIBT by default; use KCFI instead. Same as the cfi=kcfi karg.
+  # FineIBT has had a history of vulnerabilities and KCFI is more robust.
+  CONFIG_CFI_AUTO_DEFAULT
+
+  # Panic on CFI violations, as permissive mode is for development use only.
+  CONFIG_CFI_PERMISSIVE
+
   # https://www.kernelconfig.io/CONFIG_INFINIBAND
   # https://en.wikipedia.org/wiki/InfiniBand
   # InfiniBand support

patches/build-with-clang.patch

@@ -0,0 +1,13 @@
+diff --git a/kernel.spec b/kernel.spec
+index 2e03403..b31f680 100644
+--- a/kernel.spec
++++ b/kernel.spec
+@@ -13,7 +13,7 @@
+ %global _lto_cflags %{nil}
+
+ # Option to enable compiling with clang instead of gcc.
+-%bcond_with toolchain_clang
++%bcond_without toolchain_clang
+
+ %if %{with toolchain_clang}
+ %global toolchain clang