Return-path: Received: from mail-pg0-x22b.google.com ([2607:f8b0:400e:c05::22b]) by Galois.linutronix.de with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1fE2WD-0005Q0-Nr for speck@linutronix.de; Thu, 03 May 2018 02:54:45 +0200 Received: by mail-pg0-x22b.google.com with SMTP id l2-v6so11852143pgc.7 for ; Wed, 02 May 2018 17:54:45 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id s9sm24060680pfa.141.2018.05.02.17.54.37 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 02 May 2018 17:54:37 -0700 (PDT) Message-Id: =?utf-8?q?=3C5f6464d53346d3939a81cab15e5d5b20ad90c05d=2E152530?= =?utf-8?q?8267=2Egit=2Ekeescook=40chromium=2Eorg=3E?= In-Reply-To: References: From: Kees Cook Date: Tue, 1 May 2018 15:07:31 -0700 Subject: [MODERATED] [PATCH SSBv11 3/3] seccomp 0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de List-ID: When speculation flaw mitigations are opt-in (via prctl), using seccomp will automatically opt-in to these protections, since using seccomp indicates at least some level of sandboxing is desired. Signed-off-by: Kees Cook --- kernel/seccomp.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/kernel/seccomp.c b/kernel/seccomp.c index dc77548167ef..88933d05e81b 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -19,6 +19,8 @@ #include #include #include +#include +#include #include #include #include @@ -227,6 +229,19 @@ static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) return true; } +/* + * If a given speculation mitigation is opt-in (prctl()-controlled), + * select it, by disabling speculation (enabling mitigation). + */ +static inline void spec_mitigate(struct task_struct *task, + unsigned long which) +{ + int state = arch_prctl_spec_ctrl_get(task, which); + + if (state > 0 && (state & PR_SPEC_PRCTL)) + arch_prctl_spec_ctrl_set(task, which, PR_SPEC_DISABLE); +} + static inline void seccomp_assign_mode(struct task_struct *task, unsigned long seccomp_mode) { @@ -239,6 +254,9 @@ static inline void seccomp_assign_mode(struct task_struct *task, */ smp_mb__before_atomic(); set_tsk_thread_flag(task, TIF_SECCOMP); + + /* Assume seccomp processes want speculation flaw mitigation. */ + spec_mitigate(task, PR_SPEC_STORE_BYPASS); } #ifdef CONFIG_SECCOMP_FILTER -- 2.17.0