Messages in this thread Patch in this message | | | From | Willy Tarreau <> | Subject | [RFC PATCH v3 2/8] x86/pti: add new config option PER_PROCESS_PTI | Date | Wed, 10 Jan 2018 20:28:14 +0100 |
| |
This option will expose a sysctl allowing to adjust PTI per process at run time.
Signed-off-by: Willy Tarreau <w@1wt.eu> Cc: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Kees Cook <keescook@chromium.org> --- security/Kconfig | 12 ++++++++++++ 1 file changed, 12 insertions(+)
diff --git a/security/Kconfig b/security/Kconfig index 3d4debd..64adb48 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -65,6 +65,18 @@ config PAGE_TABLE_ISOLATION See Documentation/x86/pagetable-isolation.txt for more details. +config PER_PROCESS_PTI + bool "Allow page table isolation to be adjusted per process" + default n + depends on PAGE_TABLE_ISOLATION + help + This feature exposes a sysctl permitting administrators to + specifically exempt certain critical tasks from the PTI + protection at the risk of trading security for a marginal + performance increase for I/O intensive applications. + + If you are unsure how to answer this question, answer N. + config SECURITY_INFINIBAND bool "Infiniband Security Hooks" depends on SECURITY && INFINIBAND -- 1.7.12.1
| |