On Mon, Jul 27, 2015 at 12:04:54PM -0700, Kees Cook wrote:
> On Sat, Jul 25, 2015 at 6:03 AM, Willy Tarreau wrote:
> > On Sat, Jul 25, 2015 at 09:50:52AM +0200, Willy Tarreau wrote:
> >> On Fri, Jul 24, 2015 at 11:44:52PM -0700, Andy Lutomirski wrote:
> >> > I'm all for it, but I think it should b
On Sat, Jul 25, 2015 at 6:03 AM, Willy Tarreau wrote:
> On Sat, Jul 25, 2015 at 09:50:52AM +0200, Willy Tarreau wrote:
>> On Fri, Jul 24, 2015 at 11:44:52PM -0700, Andy Lutomirski wrote:
>> > I'm all for it, but I think it should be hard-disablable in config,
>> > too, for the -tiny people.
>>
>>
On Sat, Jul 25, 2015 at 10:42:14AM -0700, Andy Lutomirski wrote:
> On Sat, Jul 25, 2015 at 9:33 AM, Willy Tarreau wrote:
> > On Sat, Jul 25, 2015 at 09:08:39AM -0700, Andy Lutomirski wrote:
> >> There's one thing that I think is incomplete here. Currently, espfix
> >> triggers if SS points to the
On Sat, Jul 25, 2015 at 9:33 AM, Willy Tarreau wrote:
> On Sat, Jul 25, 2015 at 09:08:39AM -0700, Andy Lutomirski wrote:
>> There's one thing that I think is incomplete here. Currently, espfix
>> triggers if SS points to the LDT. It's possible for SS to point to
>> the LDT even with modify_ldt d
On Sat, Jul 25, 2015 at 09:08:39AM -0700, Andy Lutomirski wrote:
> There's one thing that I think is incomplete here. Currently, espfix
> triggers if SS points to the LDT. It's possible for SS to point to
> the LDT even with modify_ldt disabled, and there's a decent amount of
> attack surface the
On Sat, Jul 25, 2015 at 6:03 AM, Willy Tarreau wrote:
> On Sat, Jul 25, 2015 at 09:50:52AM +0200, Willy Tarreau wrote:
>> On Fri, Jul 24, 2015 at 11:44:52PM -0700, Andy Lutomirski wrote:
>> > I'm all for it, but I think it should be hard-disablable in config,
>> > too, for the -tiny people.
>>
>>
On Sat, Jul 25, 2015 at 09:50:52AM +0200, Willy Tarreau wrote:
> On Fri, Jul 24, 2015 at 11:44:52PM -0700, Andy Lutomirski wrote:
> > I'm all for it, but I think it should be hard-disablable in config,
> > too, for the -tiny people.
>
> I totally agree.
>
> > If we add a runtime disable, let's do
