Re: [RFC PATCH 01/56] Documentation/admin-guide: Add documentation

Borislav Petkov
2025-10-18T13:39:41Z

On Mon, Oct 13, 2025 at 09:33:49AM -0500, David Kaplan wrote:
> +Move Policy To Userspace
> +^^^^^^^^^^^^^^^^^^^^^^^^
> +
> +Mitigation choices are related to the security policy and posture of the system.
> +Most mitigations are only necessary on shared, multi-user systems if untrusted
> +code may be run on the system, such as through untrusted userspace or untrusted
> +virtual machines. The kernel may not know how the system will be used on boot,
^^^^^^^^^^

"after it has been booted" I'd say.

> +and therefore must adopt a strong security posture for safety.
> +
> +With dynamic mitigations, userspace can re-select mitigations once the needs of
> +the system can be determined and more policy information is available.
> +
> +Mitigation Testing
> +^^^^^^^^^^^^^^^^^^
> +
> +Dynamic mitigation support makes it easy to toggle individual mitigations or
> +choose between different mitigation options without the expense of a reboot or
> +kexec. This may be useful when evaluating the performance of various
> +mitigation options. It can also be useful for performing bug fixes without a

"for fixing bugs in the mitigations themselves" - simpler

> +reboot, in case a particular mitigation is undesired or buggy.

--
Regards/Gruss,
Boris.