lkml.org 
[lkml]   [2018]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [patch 24/24] x86/speculation: Add seccomp Spectre v2 app to app protection mode
Date
On Wed, Nov 21, 2018 at 09:14:54PM +0100, Thomas Gleixner wrote:
> From: Jiri Kosina <jkosina@suse.cz>
>
> If 'prctl' mode of app2app protection from spectre v2 is selected on the
> kernel command-line, STIBP and IBPB are applied on tasks which restrict
> their indirect branch speculation via prctl.
>
> SECCOMP enables the SSBD mitigation for sandboxed tasks already, so it
> makes sense to prevent spectre v2 application to application attacks as
> well.

Will need to add this chunk.

Thanks.

Tim

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c4d010d..d070e84 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -275,6 +275,7 @@ enum spectre_v2_app2app_cmd {
{ "off", SPECTRE_V2_APP2APP_CMD_NONE, false },
{ "on", SPECTRE_V2_APP2APP_CMD_FORCE, true },
{ "prctl", SPECTRE_V2_APP2APP_CMD_PRCTL, false },
+ { "seccomp", SPECTRE_V2_APP2APP_CMD_SECCOMP, false },
};

static void __init spec_v2_app_print_cond(const char *reason, bool secure)
\
 
 \ /
  Last update: 2018-11-22 03:29    [W:0.377 / U:0.964 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site