Messages in this thread | | | Date | Tue, 15 Nov 2022 21:57:59 +0100 | From | Peter Zijlstra <> | Subject | Re: [PATCH v3 36/37] x86/cet/shstk: Add ARCH_CET_UNLOCK |
| |
On Tue, Nov 15, 2022 at 08:01:12PM +0000, Edgecombe, Rick P wrote: > > > + if (task != current) { > > > + if (option == ARCH_CET_UNLOCK && > > > IS_ENABLED(CONFIG_CHECKPOINT_RESTORE)) { > > > > Why make this conditional on CRIU at all? > > Kees asked for it, I think he was worried about attackers using it to > unlock and disable shadow stack. So wanted to lock it down to the > maximum.
Well, distros will all have this stuff enabled no? So not much protection in practise.
| |