On Sun, Dec 29, 2024 at 02:44:33PM -0700, Daniel Xu wrote:
> Since 105ff5339f49 ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC"), the
> kernel has started printing a warning if neither MFD_NOEXEC_SEAL nor
> MFD_EXEC is set in memfd_create().
>
> To avoid this warning (and also be more secure), set MFD_NOEXEC_SEAL by
> default. But since libbpf can be running on potentially very old
> kernels, leave a fallback for kernels without MFD_NOEXEC_SEAL support.
>
> Signed-off-by: Daniel Xu <dxu@xxxxxxxxx>
there's similar change posted by Andrei already:
https://lore.kernel.org/bpf/eTid-pMaxx4d_gMkyFN6fgVGub01RRJYIl1SzTmRG7RtRlPUJOMrVfe2I1W8s0OBHBFy3UN2WGm_e6mak0nGcrZ4ZdxAYRUSDDcUSVMvNA4=@proton.me/T/#u
jirka
> ---
> tools/lib/bpf/libbpf.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 66173ddb5a2d..46492cc0927d 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -1731,12 +1731,24 @@ static int sys_memfd_create(const char *name, unsigned flags)
> #ifndef MFD_CLOEXEC
> #define MFD_CLOEXEC 0x0001U
> #endif
> +#ifndef MFD_NOEXEC_SEAL
> +#define MFD_NOEXEC_SEAL 0x0008U
> +#endif
>
> static int create_placeholder_fd(void)
> {
> + unsigned int flags = MFD_CLOEXEC | MFD_NOEXEC_SEAL;
> + const char *name = "libbpf-placeholder-fd";
> int fd;
>
> - fd = ensure_good_fd(sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC));
> + fd = ensure_good_fd(sys_memfd_create(name, flags));
> + if (fd >= 0)
> + return fd;
> + else if (errno != EINVAL)
> + return -errno;
> +
> + /* Possibly running on kernel without MFD_NOEXEC_SEAL */
> + fd = ensure_good_fd(sys_memfd_create(name, flags & ~MFD_NOEXEC_SEAL));
> if (fd < 0)
> return -errno;
> return fd;
> --
> 2.47.1
>
