stand: Force disable RETPOLINE for boot loaders

[emaste]

Summary

Boot loaders do not require speculative execution protection, and may be
too large if enabled.

Reported by:    Shawn Webb
Sponsored by:   The FreeBSD Foundation

[dim]

LGTM.

[imp]

stand/defs.mk

14

Are there other crazy, in the boot loader context, mitigations we should also turn off?

[emaste]

stand/defs.mk

14

Possibly INIT_ALL=none although I'm less convinced of that one. It can be a reliability improvement / defense against bugs.

There's also an argument that some of these should not be disabled, as the loader may be exposed to malicious input (either from the console or from the network). So I'm inclined to make changes incrementally here and only when needed and sensible, as with RETPOLINE.

[imp]

stand/defs.mk

14

True, kinda.
First, if you have access to the loader's keyboard, it's game over: you already own the system.
Second, even if all the 'antikeyboard interrupt' stuff is turned on, there's no way to send it a series of request that you can measure the timing of.
Third, for netboot, we don't accept connections, so there's no way to mount the typical attacks that you see for these mitigations.
Forth, for the userland programs, generally you already have elevated privs if you can interact with them...

So I lean more towards turn them all off, but doing them one at a time in a thoughtful manner is likely prudent...

[emaste]

stand/defs.mk

14

For keyboard: imagine a locked down kiosk type application that has a service option behind a password in the loader. For network, imagine a signed kernel or MD root loading over an untrusted network. Although some examples might be a bit far-fetched there is certainly an attack surface presented by the boot loader.