On Wed, Jan 25, 2023 at 03:29:07PM +0000, Reshetova, Elena wrote: > And this is a very special aspect of 'hardening' since it is about hardening a kernel > under different threat model/assumptions. I am not sure it's that special in that hardening IMHO is not a specific threat model or a set of assumptions. IIUC it's just something that helps reduce severity of vulnerabilities. Similarly, one can use the CC hardware in a variety of ways I guess. And one way is just that - hardening linux such that ability to corrupt guest memory does not automatically escalate into guest code execution. If you put it this way, you get to participate in a well understood problem space instead of constantly saying "yes but CC is special". And further, you will now talk about features as opposed to fixing bugs. Which will stop annoying people who currently seem annoyed by the implication that their code is buggy simply because it does not cache in memory all data read from hardware. Finally, you then don't really need to explain why e.g. DoS is not a problem but info leak is a problem - when for many users it's actually the reverse - the reason is not that it's not part of a threat model - which then makes you work hard to define the threat model - but simply that CC hardware does not support this kind of hardening. -- MST
