Linux 5.16 Loosens The Spectre Defaults Around SSBD / STIBP

Linux 5.16 is adjusting its default Spectre mitigation behavior around Spectre V2 for user-space tasks as well as Speculative Store Bypass Disable (SSBD) for Spectre V4 mitigation.

Rather than the existing default behavior of applying the mitigations by default to all SECCOMP threads and those opting into those mitigations per-thread via the Linux kernel's prctl() interface, with Linux 5.16 the default is being pulled back to just the prctl() opt-in behavior. This change has been talked about over the past year and previously covered within Linux Preparing To Slightly Loosen Its Spectre Defaults.

Removing the mitigations by default for SECCOMP processes is done to avoid a false sense of security particularly in cases of SMT/HT active. Through other speculative execution vulnerabilities and their mitigations and other system software changes over the past three years have led to the current default being re-evaluated with the decision to not blanket application of SSBD/STIBP by default to all SECCOMP processes.

This patch message describes the reasoning for this default change in more detail.

Ultimately setting SSBD and STIBP by default for all seccomp jails is a bad sweet spot and bad default with more cons than pros that end up reducing security in the public cloud (by giving an huge incentive to not expose SPEC_CTRL which would be needed to get full security with IBPB after setting nosmt in the guest) and by excessively hurting performance to more secure apps using seccomp that end up having to opt out with SECCOMP_FILTER_FLAG_SPEC_ALLOW.

Those wanting to keep the former default can still do so via the Spectre kernel options and sysfs.

This default change was sent in via this pull request for Linux 5.16.