Messages in this thread | | | From | David Laight <> | Subject | RE: [RFC PATCH v2 2/6] x86/arch_prctl: add ARCH_GET_NOPTI and ARCH_SET_NOPTI to enable/disable PTI | Date | Fri, 12 Jan 2018 15:03:23 +0000 |
| |
From: Willy Tarreau > Sent: 09 January 2018 12:56 > > This allows to report the current state of the PTI protection and to > enable or disable it for the current process. The state change is only > allowed if the mm is not shared (no threads have been created yet). > > Setting the flag to disable the protection is subject to CAP_SYS_RAWIO. > However it is possible to re-enable the protection without this privilege.
While a process with CAP_SYS_RAWIO can easily access kernel memory so get little extra protection from PTI, you probably want to be able to disable PTI without giving a process CAP_SYS_RAWIO. No point leaving the door wide open.
If you are trying to find the size of the performance hit you also need to be able to disable (and re-enable) PTI for all the current and future threads of a given process.
David
| |