Messages in this thread |  | | Date | Sun, 4 Feb 2018 20:39:02 +0100 | From | Dominik Brodowski <> | Subject | Re: [tip:x86/pti] x86/speculation: Use Indirect Branch Prediction Barrier in context switch |
| |
On Thu, Feb 01, 2018 at 08:31:53AM +0000, David Woodhouse wrote: > On Wed, 2018-01-31 at 08:03 +0100, Dominik Brodowski wrote: > > Whether a process needs protection by IBPB on context switches is a > > different question to whether a process should be allowed to be dumped, > > though the former may be a superset of the latter. Enable IBPB on all > > context switches to a different userspace process, until we have a clear > > mitigation strategy for userspace against Spectre-v2 designed and > > implemented. > > > > ... > > if (tsk && tsk->mm && > > - tsk->mm->context.ctx_id != last_ctx_id && > > - get_dumpable(tsk->mm) != SUID_DUMP_USER) > > + tsk->mm->context.ctx_id != last_ctx_id) > > indirect_branch_prediction_barrier(); > > > I understand your argument and I sympathise. > > But that's going to hurt a *lot*, and we don't even have a viable > proof-of-concept for a user←→user Spectre v2 attack, do we? It's only > theoretical?
Wasn't the PoC in the Spectre paper user←→user (though on a different OS)? And what makes KVM←→KVM so much more likely/dangerous/..., that IBPB will be done there unconditionally (AFAICS)?
And, somewhat related, @Tim Chen:
On Wed, Jan 31, 2018 at 03:25:44PM -0800, Tim Chen wrote: > For people who opt for more security, it is reasonable to consider > alternate policies to distinguish friend and foe so we know if we are coming > from a potentially hostile environment. Ptrace is one means to do so, and probably > there are other ways depending on usages. I hope we can have a discussion on what we should > use to determine if two processes are friend or foe. Say do all the processes > from the same containers are considered friends with each other?
To my understanding, the concept of "containers" is meant to be kept outside of the kernel. What *namespaces* / *control groups* can be considered friends with each other?
Thanks, Dominik
|  |