Since personality() accepts any flags and does not mask out any unknown bits, inform user space that such personality flag is supported via an AT_FLAGS_DENY_WRITE_EXEC flag. Signed-off-by: Catalin Marinas <catalin.marinas@xxxxxxx> Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxxxx> Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx> --- fs/binfmt_elf.c | 2 ++ include/uapi/linux/binfmts.h | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 6556e13ed95f..4e6cba1f67ee 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -265,6 +265,8 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, NEW_AUX_ENT(AT_BASE, interp_load_addr); if (bprm->interp_flags & BINPRM_FLAGS_PRESERVE_ARGV0) flags |= AT_FLAGS_PRESERVE_ARGV0; + if (IS_ENABLED(CONFIG_ARCH_ENABLE_DENY_WRITE_EXEC)) + flags |= AT_FLAGS_DENY_WRITE_EXEC; NEW_AUX_ENT(AT_FLAGS, flags); NEW_AUX_ENT(AT_ENTRY, e_entry); NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); diff --git a/include/uapi/linux/binfmts.h b/include/uapi/linux/binfmts.h index c6f9450efc12..304bbb30264c 100644 --- a/include/uapi/linux/binfmts.h +++ b/include/uapi/linux/binfmts.h @@ -22,4 +22,8 @@ struct pt_regs; #define AT_FLAGS_PRESERVE_ARGV0_BIT 0 #define AT_FLAGS_PRESERVE_ARGV0 (1 << AT_FLAGS_PRESERVE_ARGV0_BIT) +/* support for DENY_WRITE_EXEC personality flag */ +#define AT_FLAGS_DENY_WRITE_EXEC_BIT 1 +#define AT_FLAGS_DENY_WRITE_EXEC (1 << AT_FLAGS_DENY_WRITE_EXEC_BIT) + #endif /* _UAPI_LINUX_BINFMTS_H */
