config: Add DisableSpeculationMitigations

It disables speculative execution mitigations
in the container.
For more information about that, please refer to:
opencontainers/runc#2430

Signed-off-by: Kenta Tada <[email protected]>

Author: Kenta Tada

config.md

@@ -208,6 +208,9 @@ For Linux-based systems, the `process` object supports the following process-spe
     For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol][cgroup-v1-memory_2].
 * **`selinuxLabel`** (string, OPTIONAL) specifies the SELinux label for the process.
     For more information about SELinux, see  [SELinux documentation][selinux].
+* **`disableSpeculationMitigations`** (bool, OPTIONAL) specifies whether CPU speculative execution mitigations should be disabled for the process. Several mitigations are auto-enabled under Linux, and can cause a noticeable performance impact (depending on your workload). Note that enabling this option may reduce the security properties of containers created with this configuration. See [the kernel documentation][speculative-control] for more information.
+
+[speculative-control]: https://www.kernel.org/doc/html/latest/userspace-api/spec_ctrl.html
 
 ### <a name="configUser" />User
 

schema/config-schema.json

@@ -166,6 +166,9 @@
                             }
                         }
                     }
+                },
+                "disableSpeculationMitigations": {
+                    "type": "boolean"
                 }
             }
         },

schema/test/config/good/spec-example.json

@@ -56,7 +56,8 @@
         ],
         "apparmorProfile": "acme_secure_profile",
         "selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
-        "noNewPrivileges": true
+        "noNewPrivileges": true,
+        "disableSpeculationMitigations": false
     },
     "root": {
         "path": "rootfs",

specs-go/config.go

@@ -58,6 +58,8 @@ type Process struct {
 	OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"`
 	// SelinuxLabel specifies the selinux context that the container process is run as.
 	SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
+	// DisableSpeculationMitigations disables speculative execution mitigations
+	DisableSpeculationMitigations bool `json:"disableSpeculationMitigations,omitempty" platform:"linux"`
 }
 
 // LinuxCapabilities specifies the whitelist of capabilities that are kept for a process.