[RFC PATCH v3 2/8] x86/pti: add new config option PER_PROCESS_PTI

[Willy Tarreau]

This option will expose a sysctl allowing to adjust PTI per
process at run time.

Signed-off-by: Willy Tarreau <w@xxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: Brian Gerst <brgerst@xxxxxxxxx>
Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Cc: "H. Peter Anvin" <hpa@xxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
---
 security/Kconfig | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/security/Kconfig b/security/Kconfig
index 3d4debd..64adb48 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -65,6 +65,18 @@ config PAGE_TABLE_ISOLATION
 
 	  See Documentation/x86/pagetable-isolation.txt for more details.
 
+config PER_PROCESS_PTI
+	bool "Allow page table isolation to be adjusted per process"
+	default n
+	depends on PAGE_TABLE_ISOLATION
+	help
+	  This feature exposes a sysctl permitting administrators to
+	  specifically exempt certain critical tasks from the PTI
+	  protection at the risk of trading security for a marginal
+	  performance increase for I/O intensive applications.
+
+	  If you are unsure how to answer this question, answer N.
+
 config SECURITY_INFINIBAND
 	bool "Infiniband Security Hooks"
 	depends on SECURITY && INFINIBAND
-- 
1.7.12.1