Re: [PATCH] x86/alternatives: Make FineIBT mode Kconfig selectable

[jvoisin]

> Since FineIBT performs checking at the destination, it is weaker against
> attacks that can construct arbitrary executable memory contents. As such,
> some system builders want to run with FineIBT disabled by default. Allow
> the "cfi=kcfi" boot param mode to be selectable through Kconfig via the
> newly introduced CONFIG_CFI_AUTO_DEFAULT.

I'm confused as why you think that KCFI is stronger/better than FineIBT.
The latter is compatible with execute-only memory, makes use of hardware
support, doesn't need LTO, is faster, … moreover, I don't see why an
attacker able to "construct arbitrary executable memory contents"
wouldn't be able to bypass KCFI as well, since its threat model
(https://github.com/kcfi/docs/blob/master/kCFI_whitepaper.pdf)
explicitly says "We assume an OS that fully implements the W^X policy
[56,58,106] preventing direct code injection in kernel space."