On Wed, 3 Mar 2021 18:22:00 +0200 Mike Rapoport <rppt@xxxxxxxxxx> wrote: > This is an implementation of "secret" mappings backed by a file descriptor. > > The file descriptor backing secret memory mappings is created using a > dedicated memfd_secret system call The desired protection mode for the > memory is configured using flags parameter of the system call. The mmap() > of the file descriptor created with memfd_secret() will create a "secret" > memory mapping. The pages in that mapping will be marked as not present in > the direct map and will be present only in the page table of the owning mm. > > Although normally Linux userspace mappings are protected from other users, > such secret mappings are useful for environments where a hostile tenant is > trying to trick the kernel into giving them access to other tenants > mappings. I continue to struggle with this and I don't recall seeing much enthusiasm from others. Perhaps we're all missing the value point and some additional selling is needed. Am I correct in understanding that the overall direction here is to protect keys (and perhaps other things) from kernel bugs? That if the kernel was bug-free then there would be no need for this feature? If so, that's a bit sad. But realistic I guess. Is this intended to protect keys/etc after the attacker has gained the ability to run arbitrary kernel-mode code? If so, that seems optimistic, doesn't it? I think that a very complete description of the threats which this feature addresses would be helpful.
