linux-kernel - Re: [patch 24/24] x86/speculation: Add seccomp Spectre v2 app to app protection mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.21.1811230042360.1665@nanos.tec.linutronix.de>
Date:   Fri, 23 Nov 2018 00:45:19 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Ingo Molnar <mingo@...nel.org>
cc:     LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jiri Kosina <jkosina@...e.cz>,
        Tom Lendacky <thomas.lendacky@....com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Andi Kleen <ak@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Casey Schaufler <casey.schaufler@...el.com>,
        Asit Mallick <asit.k.mallick@...el.com>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Jon Masters <jcm@...hat.com>,
        Waiman Long <longman9394@...il.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        Dave Stewart <david.c.stewart@...el.com>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [patch 24/24] x86/speculation: Add seccomp Spectre v2 app to
 app protection mode

On Thu, 22 Nov 2018, Ingo Molnar wrote:
> > +	[SPECTRE_V2_APP2APP_SECCOMP]	= "App-App Mitigation: seccomp and prctl opt-in",
> 
> This description is not accurate: it's not a 'seccomp and prctl opt-in', 
> the seccomp functionality is opt-out, the prctl is opt-in.
> 
> So something like:
> 
> > +	[SPECTRE_V2_APP2APP_SECCOMP]	= "App-App Mitigation: seccomp by default and prctl opt-in",

Na. I just make it: "prctl" and "seccomp + prctl" 

> >  void arch_seccomp_spec_mitigate(struct task_struct *task)
> >  {
> >  	if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
> >  		ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
> > +	if (spectre_v2_app2app == SPECTRE_V2_APP2APP_SECCOMP)
> > +		indir_branch_prctl_set(task, PR_SPEC_FORCE_DISABLE);
> >  }
> >  #endif
> 
> Hm, so isn't arch_seccomp_spec_mitigate() called right before untrusted 
> seccomp code is executed? So why are we disabling the mitigation here?

It disables the CPU speculation misfeature not the mitigation. And no, we
are not going to change it because the constants are user space ABI today.

Thanks,

	tglx