| From | Tim Chen <> | Subject | Re: [patch 24/24] x86/speculation: Add seccomp Spectre v2 app to app protection mode | Date | Wed, 21 Nov 2018 18:24:32 -0800 |
| |
On Wed, Nov 21, 2018 at 09:14:54PM +0100, Thomas Gleixner wrote: > From: Jiri Kosina <jkosina@suse.cz> > > If 'prctl' mode of app2app protection from spectre v2 is selected on the > kernel command-line, STIBP and IBPB are applied on tasks which restrict > their indirect branch speculation via prctl. > > SECCOMP enables the SSBD mitigation for sandboxed tasks already, so it > makes sense to prevent spectre v2 application to application attacks as > well.
Will need to add this chunk.
Thanks.
Tim
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index c4d010d..d070e84 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -275,6 +275,7 @@ enum spectre_v2_app2app_cmd { { "off", SPECTRE_V2_APP2APP_CMD_NONE, false }, { "on", SPECTRE_V2_APP2APP_CMD_FORCE, true }, { "prctl", SPECTRE_V2_APP2APP_CMD_PRCTL, false }, + { "seccomp", SPECTRE_V2_APP2APP_CMD_SECCOMP, false }, }; static void __init spec_v2_app_print_cond(const char *reason, bool secure)
|