On Tue, Aug 15, 2017 at 10:11:27AM -0700, Dan Williams wrote: > > We had issues before with user-imposed ETXTBSY. See MAP_DENYWRITE. > > > > Are we sure it won't a source of denial-of-service attacks? > > I believe MAP_DENYWRITE allowed any application with read access to be > able to deny writes which is obviously problematic. MAP_DIRECT is > different. You need write access to the file so you can already > destroy data that another application might depend on, and this only > blocks allocation and reflink. > > However, I'm not opposed to adding more safety around this. I think we > can address this concern with an fcntl seal as Dave suggests, but the > seal only applies to the 'struct file' instance and only gates whether > MAP_DIRECT is allowed on that file. The act of setting > F_MAY_SEAL_IOMAP requires CAP_IMMUTABLE, but MAP_DIRECT does not. This > allows the 'permission to mmap(MAP_DIRECT)' to be passed around with > an open file descriptor. Sounds like a good approach to me. -- Kirill A. Shutemov
