Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET_NOPTI to enable/disable PTI

[Borislav Petkov]

On Tue, Jan 09, 2018 at 03:36:53PM +0100, Willy Tarreau wrote:
> I see and am not particularly against this, but what use case do you
> have in mind precisely ? I doubt it's just saving a few tens of bytes,
> so probably you're more concerned about the potential risks this opens ?
> But given we only allow this for CAP_SYS_RAWIO and these ones already
> have access to /dev/mem and many other things, don't you think there
> are much easier ways to dump kernel memory in this case than trying to
> inject some meltdown code into the victim process ? Or maybe you have
> other cases in mind that I'm not seeing.

I'd like this to be config-controllable so that distros can make the
decision whether/if they want to support the whole per-mm thing.

Also, if CAP_SYS_RAWIO is going to protect, please make the
ARCH_GET_NOPTI variant check it too.

Thx.

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.