Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET_NOPTI to enable/disable PTI

[Willy Tarreau]

On Fri, Jan 12, 2018 at 03:03:23PM +0000, David Laight wrote:
> From: Willy Tarreau
> > Sent: 09 January 2018 12:56
> > 
> > This allows to report the current state of the PTI protection and to
> > enable or disable it for the current process. The state change is only
> > allowed if the mm is not shared (no threads have been created yet).
> > 
> > Setting the flag to disable the protection is subject to CAP_SYS_RAWIO.
> > However it is possible to re-enable the protection without this privilege.
> 
> While a process with CAP_SYS_RAWIO can easily access kernel memory so
> get little extra protection from PTI, you probably want to be able
> to disable PTI without giving a process CAP_SYS_RAWIO.
> No point leaving the door wide open.

Sure but if it's only a wrapper you don't mind. Start with the capability,
disable PTI, drop the capability and that's done.

Willy