Return-path: Received: from mail-pg0-x235.google.com ([2607:f8b0:400e:c05::235]) by Galois.linutronix.de with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1fE2W9-0005Px-Ch for speck@linutronix.de; Thu, 03 May 2018 02:54:41 +0200 Received: by mail-pg0-x235.google.com with SMTP id p9-v6so8954526pgc.9 for ; Wed, 02 May 2018 17:54:41 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id u4sm22075363pfh.120.2018.05.02.17.54.33 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 02 May 2018 17:54:33 -0700 (PDT) Message-Id: =?utf-8?q?=3Cd2274078fb39a64d91a5e81473c816b12dba7b98=2E152530?= =?utf-8?q?8267=2Egit=2Ekeescook=40chromium=2Eorg=3E?= In-Reply-To: References: From: Kees Cook Date: Tue, 1 May 2018 15:31:45 -0700 Subject: [MODERATED] [PATCH SSBv11 2/3] seccomp 3 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de List-ID: As done with seccomp and no_new_privs, also show speculation flaw mitigation state in /proc/$pid/status. Signed-off-by: Kees Cook --- fs/proc/array.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/fs/proc/array.c b/fs/proc/array.c index ae2c807fd719..303c155f9b04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -85,6 +85,7 @@ #include #include #include +#include #include #include #include @@ -335,6 +336,27 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) #ifdef CONFIG_SECCOMP seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode); #endif + seq_printf(m, "\nSpeculation Store Bypass:\t"); + switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { + case -EINVAL: + seq_printf(m, "unknown"); + break; + case PR_SPEC_NOT_AFFECTED: + seq_printf(m, "not vulnerable"); + break; + case PR_SPEC_PRCTL | PR_SPEC_DISABLE: + seq_printf(m, "thread mitigated"); + break; + case PR_SPEC_PRCTL | PR_SPEC_ENABLE: + seq_printf(m, "thread vulnerable"); + break; + case PR_SPEC_DISABLE: + seq_printf(m, "globally mitigated"); + break; + default: + seq_printf(m, "vulnerable"); + break; + } seq_putc(m, '\n'); } -- 2.17.0