Fedora 31 compiles everything with -fcf-protection. Of course it requires hardware support before it actually does anything, and there is a lot of missing support in the non-C toolchain and in certain packages. You can use "annocheck" to check if a particular binary is compiled with full control flow protection or not, eg:

    $ annocheck -v /usr/bin/ls
    [...]
    Hardened: /usr/bin/ls: PASS: Compiled with -fcf-protection.