Re: [PATCH] Sample fix for hyperthread exploit

Amit Shah
2005-06-02T06:32:41Z

Ingo Molnar wrote:

>
> * Arjan van de Ven <arjan@infradead.org> wrote:
>
>> > Also, uid is not sufficient. Something more comprehensive (like
>> > ability to ptrace) would be appropriate.
>>
>> I would go a lot simpler. App says "I want exclusivity" via pctl and
>> NOTHING runs on the other half. Well maybe with exceptions of
>> processes that share the mm with the exclusive one (in practice
>> "threads") since those could just read the memory anyway.
>
> this has the disadvantage of needing changes in the security apps.
> Basing this off the uid (or the ability to ptrace) makes it at least
> automatic - but introduces a permanent penalty not only on multiuser
> boxes, but on basically any server box that runs multiple services.

Can this be not limited to just not running any other process on the same
(SMT-enabled) processor (precondition being ability to ptrace)?

Amit.
--
Amit Shah