From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754214AbeAJT3s (ORCPT + 1 other); Wed, 10 Jan 2018 14:29:48 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:39494 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752621AbeAJT3r (ORCPT ); Wed, 10 Jan 2018 14:29:47 -0500 From: Willy Tarreau To: linux-kernel@vger.kernel.org, x86@kernel.org Cc: Willy Tarreau , Andy Lutomirski , Borislav Petkov , Brian Gerst , Dave Hansen , Ingo Molnar , Linus Torvalds , Peter Zijlstra , Thomas Gleixner , Josh Poimboeuf , "H. Peter Anvin" , Kees Cook Subject: [RFC PATCH v3 2/8] x86/pti: add new config option PER_PROCESS_PTI Date: Wed, 10 Jan 2018 20:28:14 +0100 Message-Id: <1515612500-14505-3-git-send-email-w@1wt.eu> X-Mailer: git-send-email 2.8.0.rc2.1.gbe9624a In-Reply-To: <1515612500-14505-1-git-send-email-w@1wt.eu> References: <1515612500-14505-1-git-send-email-w@1wt.eu> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: This option will expose a sysctl allowing to adjust PTI per process at run time. Signed-off-by: Willy Tarreau Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Ingo Molnar Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Josh Poimboeuf Cc: "H. Peter Anvin" Cc: Kees Cook --- security/Kconfig | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/Kconfig b/security/Kconfig index 3d4debd..64adb48 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -65,6 +65,18 @@ config PAGE_TABLE_ISOLATION See Documentation/x86/pagetable-isolation.txt for more details. +config PER_PROCESS_PTI + bool "Allow page table isolation to be adjusted per process" + default n + depends on PAGE_TABLE_ISOLATION + help + This feature exposes a sysctl permitting administrators to + specifically exempt certain critical tasks from the PTI + protection at the risk of trading security for a marginal + performance increase for I/O intensive applications. + + If you are unsure how to answer this question, answer N. + config SECURITY_INFINIBAND bool "Infiniband Security Hooks" depends on SECURITY && INFINIBAND -- 1.7.12.1