On Thu, Feb 01, 2018 at 08:31:53AM +0000, David Woodhouse wrote: > On Wed, 2018-01-31 at 08:03 +0100, Dominik Brodowski wrote: > > Whether a process needs protection by IBPB on context switches is a > > different question to whether a process should be allowed to be dumped, > > though the former may be a superset of the latter. Enable IBPB on all > > context switches to a different userspace process, until we have a clear > > mitigation strategy for userspace against Spectre-v2 designed and > > implemented. > > > > ... > > if (tsk && tsk->mm && > > - tsk->mm->context.ctx_id != last_ctx_id && > > - get_dumpable(tsk->mm) != SUID_DUMP_USER) > > + tsk->mm->context.ctx_id != last_ctx_id) > > indirect_branch_prediction_barrier(); > > > I understand your argument and I sympathise. > > But that's going to hurt a *lot*, and we don't even have a viable > proof-of-concept for a user←→user Spectre v2 attack, do we? It's only > theoretical? > > Show a working PoC and it makes the argument somewhat more > convincing...
Fair point. From what I can gather, user space ASLR seems to be the only layer of protection before a POC would be feasible. So, unless I'm mistaken, which is very possible, it seems to be a question of how much we trust ASLR. -- Josh
