> Since FineIBT performs checking at the destination, it is weaker against > attacks that can construct arbitrary executable memory contents. As such, > some system builders want to run with FineIBT disabled by default. Allow > the "cfi=kcfi" boot param mode to be selectable through Kconfig via the > newly introduced CONFIG_CFI_AUTO_DEFAULT.
I'm confused as why you think that KCFI is stronger/better than FineIBT. The latter is compatible with execute-only memory, makes use of hardware support, doesn't need LTO, is faster, … moreover, I don't see why an attacker able to "construct arbitrary executable memory contents" wouldn't be able to bypass KCFI as well, since its threat model (https://github.com/kcfi/docs/blob/master/kCFI_whitepaper.pdf) explicitly says "We assume an OS that fully implements the W^X policy [56,58,106] preventing direct code injection in kernel space."
