Explicitly disable speculation

PiperOrigin-RevId: 818598246
Change-Id: I00df56fd033873d3210abed39a0a5b1ad90ccdae

Author: happyCoder92

sandboxed_api/sandbox2/BUILD

@@ -592,6 +592,7 @@ cc_library(
         ":policy",
         ":sanitizer",
         ":syscall",
+        "//sandboxed_api:config",
         "//sandboxed_api/sandbox2/network_proxy:client",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:raw_logging",

sandboxed_api/sandbox2/CMakeLists.txt

@@ -562,6 +562,7 @@ target_link_libraries(sandbox2_client
           sandbox2::sanitizer
           sandbox2::syscall
           sapi::base
+          sapi::config
           sapi::raw_logging
   PUBLIC absl::flat_hash_map
          absl::status

sandboxed_api/sandbox2/client.cc

@@ -45,6 +45,7 @@
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
+#include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/logsink.h"
 #include "sandboxed_api/sandbox2/network_proxy/client.h"
@@ -331,6 +332,18 @@ void Client::ApplyPolicyAndBecomeTracee() {
   SAPI_RAW_CHECK(comms_->RecvUint32(&message),
                  "receving confirmation from executor");
   bool allow_speculation = message & kAllowSpeculationBit;
+  if (!allow_speculation) {
+    if constexpr (sapi::host_cpu::IsX8664() || sapi::host_cpu::IsArm64()) {
+      SAPI_RAW_PCHECK(prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS,
+                            PR_SPEC_FORCE_DISABLE, 0, 0) == 0,
+                      "could not disable store bypass speculation");
+    }
+    if constexpr (sapi::host_cpu::IsX8664()) {
+      SAPI_RAW_PCHECK(prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH,
+                            PR_SPEC_FORCE_DISABLE, 0, 0) == 0,
+                      "could not disable indirect branch speculation");
+    }
+  }
   uint32_t seccomp_extra_flags =
       allow_speculation ? SECCOMP_FILTER_FLAG_SPEC_ALLOW : 0;
   uint32_t monitor_type = message & kMonitorTypeMask;