Intel Developer's Patch To Let SECCOMP Processes Like Web Browsers Opt Out Of Spectre V4

Currently the Linux kernel SECCOMP secure computing mode force-enables Spectre protections, which comes with obvious performance implications. When force-enabled, however, processes can't opt-out of the protection if they are not at risk to the likes of Spectre V4 "Speculative Store Bypass" issues. But a simple change being proposed would let such processes opt out if desired.

Longtime Intel Linux developer Andi Kleen has proposed the change to allow overriding SECCOMP's speculation disable behavior. Rather than force disabling the speculation control, it still would happen by default but not "forced" -- which in turn would let processes opt-out of the behavior due to that semantic change. The PR_SET_SPECULATION prctl can then be used for toggling SSBD and IB behavior.

Kleen's motivation appears to be largely influenced by offsetting the SSBD performance hit to web browsers. "The seccomp user has a superior mitigation and doesn't need the CPU level disables. For example for a Web Browser this is using site isolation, which separates different sites in different processes, so side channel leaks inside a process are not of a concern...In some cases we're seeing significant performance penalties of enabling the SSBD mitigation on web workloads."

Kleen went on to add with the patch, "Longer term we probably need to discuss if the seccomp heuristic is still warranted and should be perhaps changed. It seemed like a good idea when these vulnerabilities were new, and no web browsers supported site isolation. But with site isolation widely deployed -- Chrome has it on by default, and as I understand it, Firefox is going to enable it by default soon. And other seccomp users (like sshd or systemd) probably don't really need it. Given that it's not clear the default heuristic is still a good idea."

Besides web browsers using SECCOMP for sandboxing some processes, it is also used by the likes of Docker, VSFTPD, Flatpak, LXD, and many other Linux processes. To reiterate though no out-of-the-box change in mitigation behavior besides allowing SECCOMP processes to opt-out if they choose to do so.

Kleen's patch was volleyed yesterday but so far hasn't received any feedback. We'll keep monitoring to see if this change gets accepted for the forthcoming Linux 5.7 cycle.