Messages in this thread | | | From | Amit Shah <> | Subject | Re: [PATCH] Sample fix for hyperthread exploit | Date | Thu, 02 Jun 2005 11:58:45 +0530 |
| |
Ingo Molnar wrote:
> > * Arjan van de Ven <arjan@infradead.org> wrote: > >> > Also, uid is not sufficient. Something more comprehensive (like >> > ability to ptrace) would be appropriate. >> >> I would go a lot simpler. App says "I want exclusivity" via pctl and >> NOTHING runs on the other half. Well maybe with exceptions of >> processes that share the mm with the exclusive one (in practice >> "threads") since those could just read the memory anyway. > > this has the disadvantage of needing changes in the security apps. > Basing this off the uid (or the ability to ptrace) makes it at least > automatic - but introduces a permanent penalty not only on multiuser > boxes, but on basically any server box that runs multiple services.
Can this be not limited to just not running any other process on the same (SMT-enabled) processor (precondition being ability to ptrace)?
Amit. -- Amit Shah http://amitshah.net/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |