Messages in this thread | | | Date | Tue, 15 Nov 2022 13:00:40 -0800 | Subject | Re: [PATCH v3 36/37] x86/cet/shstk: Add ARCH_CET_UNLOCK | From | Dave Hansen <> |
| |
On 11/15/22 12:57, Peter Zijlstra wrote: > On Tue, Nov 15, 2022 at 08:01:12PM +0000, Edgecombe, Rick P wrote: >>>> + if (task != current) { >>>> + if (option == ARCH_CET_UNLOCK && >>>> IS_ENABLED(CONFIG_CHECKPOINT_RESTORE)) { >>> Why make this conditional on CRIU at all? >> Kees asked for it, I think he was worried about attackers using it to >> unlock and disable shadow stack. So wanted to lock it down to the >> maximum. > Well, distros will all have this stuff enabled no? So not much > protection in practise.
Yeah, that's true for the distros.
But, I would imagine that our more paranoid friends like the ChromeOS folks might appreciate this.
| |