I have some servers that run applications that use IPC/RPC heavily and are sensitive to the delays of a syscall.

If this server is hardened to only run trusted code (e.g. automated code deployment after code review and change approval and no interactive logon possible), would this be sufficient to disable KPTI for performance reasons.

1 Answer 1


If you only run fully trusted code on your server which only handles fully trusted data so that only predictable harmless code execution is done then you don't need to have any kind of security on this system - this include KPTI.

If you are not completely sure about the innocence of the code on the system or the data processed by the code then you should add some security. Since all security measures are associated with some costs (performance, maintenance, usability...) you have to balance the costs against the gains. How this balance looks in your specific case depends a lot on how much do you believe in the innocence of the code and data you process on the system.

  • Thanks for the trusted data idea. I have not considered that.
    – billc.cn
    Jan 5, 2018 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .