linux-kernel - Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180110161929.GA14347@1wt.eu>
Date:   Wed, 10 Jan 2018 17:19:29 +0100
From:   Willy Tarreau <w@....eu>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Andy Lutomirski <luto@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, X86 ML <x86@...nel.org>,
        Brian Gerst <brgerst@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, Kees Cook <keescook@...omium.org>
Subject: Re: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and
 ARCH_SET_NOPTI to enable/disable PTI

On Wed, Jan 10, 2018 at 05:09:22PM +0100, Borislav Petkov wrote:
> On Wed, Jan 10, 2018 at 04:39:46PM +0100, Willy Tarreau wrote:
> > For production, disabling PTI system-wide when I'm supposed to know what
> > performance critical processes should be exempted doesn't appeal me very
> > much, especially if it can happen by accident. So in the end I think that
> > "pti=off" on the cmdline should be the only way to disable it system-wide
> > as it doesn't represent a reasonable production case. Disabling it per
> > process should be allowed via a sysctl, which would also be locked disabled
> > for safety purposes.
> 
> It still might make sense to be able to disable it system-wide without
> having to reboot. Imagine a bunch of processes showing performance
> regressions and you want to disable PTI completely to rule it out
> causing that regression. Then you toggle the master switch.

Well, indeed. It will never be 100% equivalent to pti=off however since
the alternative code will remain in place, but why not. Or maybe we have
a way to change the alternatives at run time by changing a sysctl, but
that doesn't please me a lot. I'll check this after the rest however,
as I'm not sure about the code implications in the entry code (i.e. we'd
rather not check a system wide variable, or we might need another per-CPU
one). We could also just mention that the setting only applies to future
processes, which will be much easier and probably sufficient.

Willy