linux-kernel - Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jKu4ohTmZ=W6gLF2U+hAguTbGYkY9jryyJiV2eNZqak0w@mail.gmail.com>
Date:   Tue, 9 Jan 2018 13:50:10 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Willy Tarreau <w@....eu>
Cc:     Andy Lutomirski <luto@...nel.org>, Borislav Petkov <bp@...en8.de>,
        LKML <linux-kernel@...r.kernel.org>, X86 ML <x86@...nel.org>,
        Brian Gerst <brgerst@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and
 ARCH_SET_NOPTI to enable/disable PTI

On Tue, Jan 9, 2018 at 1:41 PM, Willy Tarreau <w@....eu> wrote:
> On Tue, Jan 09, 2018 at 01:26:57PM -0800, Andy Lutomirski wrote:
>> So I
>> think we should require CAP_SYS_RAWIO *and* that the system is booted
>> with pti=allow_optout or something like that.
>
> I'm really not fan of this. 1) it would require to reboot during the
> peak hour to try to fix the problem. 2) the flag will end up being
> deployed everywhere by default in environments flirting with performance
> "just in case" so it will be rendered useless.
>
> I'm fine with Boris' requirement that the kernel should be build with
> the appropriate option to support this. If you're doing your own builds,
> you can well take care of having the appropriate options (PTI+the right
> to turn it off) and deploy such kernels where relevant.

IMO, run-time selection is always better than build-time selection.
e.g. a distro would build it in just in case anyone needs it, but the
vast majority of system this would be dangerous on. Therefore, make it
part of the kernel, but require it be enabled at boot.

-Kees

-- 
Kees Cook
Pixel Security