Re: [patch 24/24] x86/speculation: Add seccomp Spectre v2 app to app protection mode

[Tim Chen]

On Wed, Nov 21, 2018 at 09:14:54PM +0100, Thomas Gleixner wrote:
> From: Jiri Kosina <jkosina@xxxxxxx>
> 
> If 'prctl' mode of app2app protection from spectre v2 is selected on the
> kernel command-line, STIBP and IBPB are applied on tasks which restrict
> their indirect branch speculation via prctl.
> 
> SECCOMP enables the SSBD mitigation for sandboxed tasks already, so it
> makes sense to prevent spectre v2 application to application attacks as
> well.

Will need to add this chunk.

Thanks.

Tim

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c4d010d..d070e84 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -275,6 +275,7 @@ enum spectre_v2_app2app_cmd {
 	{ "off",	SPECTRE_V2_APP2APP_CMD_NONE,	false },
 	{ "on",		SPECTRE_V2_APP2APP_CMD_FORCE,	true  },
 	{ "prctl",	SPECTRE_V2_APP2APP_CMD_PRCTL,	false },
+	{ "seccomp",	SPECTRE_V2_APP2APP_CMD_SECCOMP,	false },
 };
 
 static void __init spec_v2_app_print_cond(const char *reason, bool secure)