lkml.org 
[lkml]   [2018]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET_NOPTI to enable/disable PTI
Date
From: Willy Tarreau
> Sent: 09 January 2018 12:56
>
> This allows to report the current state of the PTI protection and to
> enable or disable it for the current process. The state change is only
> allowed if the mm is not shared (no threads have been created yet).
>
> Setting the flag to disable the protection is subject to CAP_SYS_RAWIO.
> However it is possible to re-enable the protection without this privilege.

While a process with CAP_SYS_RAWIO can easily access kernel memory so
get little extra protection from PTI, you probably want to be able
to disable PTI without giving a process CAP_SYS_RAWIO.
No point leaving the door wide open.

If you are trying to find the size of the performance hit you also
need to be able to disable (and re-enable) PTI for all the current and
future threads of a given process.

David

\
 
 \ /
  Last update: 2018-01-14 23:25    [W:0.183 / U:1.120 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site