On Tue, Nov 20, 2018 at 4:33 PM Tim Chen tim.c.chen@linux.intel.com wrote:
Implements arch_update_spec_restriction() for x86. Use STIBP to restrict speculative execution when running a task set to non-dumpable, or clear the restriction if the task is set to dumpable.
I don't think this necessarily makes sense.
The new "auto" behavior is that we aim to restrict untrusted code (and the loader of such code uses prctrl to set that flag), then this whole "set STIBP for non-dumpable" makes little sense.
A non-dumpable app by definition is *more* trusted, not less trusted.
So this model of "let's disable prediction for system processes" not only doesn't make sense, but it also unnecessarily penalizes those potentially very important system processes.
Also, "dumpable" in general is pretty oddly defined to be used for this.
The same (privileged) process can be dumpable or not depending on how it was started (ie if it was started by a regular user and became trusted through suid, it's not dumpable, but if it was started from a root process it remains dumpable.
So I'm just not convinced "dumpability" is meaningful for STIBP.
Linus