Messages in this thread |  | | Subject | Re: Avoid speculative indirect calls in kernel | From | Jon Masters <> | Date | Thu, 4 Jan 2018 23:11:58 -0500 |
| |
On 01/04/2018 07:54 PM, Thomas Gleixner wrote: > On Thu, 4 Jan 2018, Jon Masters wrote: >> P.S. I've an internal document where I've been tracking "nice to haves" >> for later, and one of them is whether it makes sense to tag binaries as >> "trusted" (e.g. extended attribute, label, whatever). It was something I >> wanted to bring up at some point as potentially worth considering. > > Scratch that. There is no such thing as a trusted binary.
I agree with your sentiment, but for those mitigations that carry a significant performance overhead (for example IBRS at the moment, and on some other architectures where we might not end up with retpolines) there /could/ be some value in leaving them on by default but allowing a sysadmin to decide to trust a given application/container and accept the risk. Sure, it's selectively weakened security, I get that. I am not necessarily advocating this, just suggesting it be discussed.
[ I also totally get that you can extend variant 2 to have any application that interacts with another abuse it (even over a pipe or a socket, etc. provided they share the same cache and take untrusted data that can lead to some kind of load within a speculation window), and there are a ton of ways to still cause an attack in that case. ]
Jon.
-- Computer Architect | Sent from my Fedora powered laptop
|  |