Intel Developer's Patch To Let SECCOMP Processes Like Web Browsers Opt Out Of Spectre V4

Written by Michael Larabel in Intel on 13 March 2020 at 08:08 AM EDT. 11 Comments
Currently the Linux kernel SECCOMP secure computing mode force-enables Spectre protections, which comes with obvious performance implications. When force-enabled, however, processes can't opt-out of the protection if they are not at risk to the likes of Spectre V4 "Speculative Store Bypass" issues. But a simple change being proposed would let such processes opt out if desired.

Longtime Intel Linux developer Andi Kleen has proposed the change to allow overriding SECCOMP's speculation disable behavior. Rather than force disabling the speculation control, it still would happen by default but not "forced" -- which in turn would let processes opt-out of the behavior due to that semantic change. The PR_SET_SPECULATION prctl can then be used for toggling SSBD and IB behavior.

Kleen's motivation appears to be largely influenced by offsetting the SSBD performance hit to web browsers. "The seccomp user has a superior mitigation and doesn't need the CPU level disables. For example for a Web Browser this is using site isolation, which separates different sites in different processes, so side channel leaks inside a process are not of a concern...In some cases we're seeing significant performance penalties of enabling the SSBD mitigation on web workloads."

Kleen went on to add with the patch, "Longer term we probably need to discuss if the seccomp heuristic is still warranted and should be perhaps changed. It seemed like a good idea when these vulnerabilities were new, and no web browsers supported site isolation. But with site isolation widely deployed -- Chrome has it on by default, and as I understand it, Firefox is going to enable it by default soon. And other seccomp users (like sshd or systemd) probably don't really need it. Given that it's not clear the default heuristic is still a good idea."

Besides web browsers using SECCOMP for sandboxing some processes, it is also used by the likes of Docker, VSFTPD, Flatpak, LXD, and many other Linux processes. To reiterate though no out-of-the-box change in mitigation behavior besides allowing SECCOMP processes to opt-out if they choose to do so.

Kleen's patch was volleyed yesterday but so far hasn't received any feedback. We'll keep monitoring to see if this change gets accepted for the forthcoming Linux 5.7 cycle.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week