Right now the only possibility to specify that combination -fcf-protection=full, but this is not future proof; if other suboptions are added later, they could be applied to code that does not support them. Code that wants to be reliable against future extensions to -fcf-protection needs to specify each desired option manually, as in "-fcf-protection=branch,return". Upstream bug https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89701