lkml.org 
[lkml]   [2018]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC PATCH v3 2/8] x86/pti: add new config option PER_PROCESS_PTI
Date
This option will expose a sysctl allowing to adjust PTI per
process at run time.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
---
security/Kconfig | 12 ++++++++++++
1 file changed, 12 insertions(+)

diff --git a/security/Kconfig b/security/Kconfig
index 3d4debd..64adb48 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -65,6 +65,18 @@ config PAGE_TABLE_ISOLATION

See Documentation/x86/pagetable-isolation.txt for more details.

+config PER_PROCESS_PTI
+ bool "Allow page table isolation to be adjusted per process"
+ default n
+ depends on PAGE_TABLE_ISOLATION
+ help
+ This feature exposes a sysctl permitting administrators to
+ specifically exempt certain critical tasks from the PTI
+ protection at the risk of trading security for a marginal
+ performance increase for I/O intensive applications.
+
+ If you are unsure how to answer this question, answer N.
+
config SECURITY_INFINIBAND
bool "Infiniband Security Hooks"
depends on SECURITY && INFINIBAND
--
1.7.12.1
\
 
 \ /
  Last update: 2018-01-14 23:22    [W:0.081 / U:0.588 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site