On Fri, Jan 12, 2018 at 03:03:23PM +0000, David Laight wrote: > From: Willy Tarreau > > Sent: 09 January 2018 12:56 > > > > This allows to report the current state of the PTI protection and to > > enable or disable it for the current process. The state change is only > > allowed if the mm is not shared (no threads have been created yet). > > > > Setting the flag to disable the protection is subject to CAP_SYS_RAWIO. > > However it is possible to re-enable the protection without this privilege. > > While a process with CAP_SYS_RAWIO can easily access kernel memory so > get little extra protection from PTI, you probably want to be able > to disable PTI without giving a process CAP_SYS_RAWIO. > No point leaving the door wide open.
Sure but if it's only a wrapper you don't mind. Start with the capability, disable PTI, drop the capability and that's done. Willy