mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-16 14:03:00 +02:00
64 lines
2.5 KiB
Bash
64 lines
2.5 KiB
Bash
#!/bin/sh
|
|
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
. /etc/sysconfig/rc
|
|
. ${rc_functions}
|
|
|
|
eval $(/usr/local/bin/readhash /var/ipfire/main/security)
|
|
|
|
case "${1}" in
|
|
start)
|
|
# Nothing to do here when SMT is forced on
|
|
if [ "${ENABLE_SMT}" = "on" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Nothing to do when SMT is not enabled or not supported anyways
|
|
if [ "$(</sys/devices/system/cpu/smt/control)" != "on" ]; then
|
|
exit 0
|
|
fi 2>/dev/null
|
|
|
|
# Do not disable SMT inside virtual machines
|
|
if running_on_hypervisor; then
|
|
exit 0
|
|
fi
|
|
|
|
# Disable SMT when the processor is vulnerable if SMT is enabled
|
|
for vuln in $(ls /sys/devices/system/cpu/vulnerabilities/*) ; do
|
|
if [ -r "${vuln}" ] && \
|
|
[[ "$(<${vuln})" =~ "SMT vulnerable" ]]; then
|
|
# Disable SMT
|
|
boot_mesg "Disabling Simultaneous Multi-Threading (SMT)..."
|
|
echo "forceoff" > /sys/devices/system/cpu/smt/control
|
|
echo_ok
|
|
|
|
# No need to check any further when we have disabled SMT already
|
|
break
|
|
fi
|
|
done
|
|
;;
|
|
|
|
*)
|
|
echo "Usage: ${0} {start}"
|
|
exit 1
|
|
;;
|
|
esac
|