Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Tue, 14 May 2024 at 18:47, Theo de Raadt <deraadt@xxxxxxxxxxx> wrote:
> >
> > Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> >
> > Regarding mprotect(), POSIX also says:
> >
> > An implementation may permit accesses other than those specified by
> > prot; however, no implementation shall permit a write to succeed where
> > PROT_WRITE has not been set or shall permit any access where PROT_NONE
> > alone has been set.
>
> Why do you quote entirely irrelevant issues?
>
> If the mprotect didn't succeed, then clearly the above is irrelevant.
Imagine the following region:
<--------------------------------------------- len
[region PROT_READ] [region PROT_READ + sealed]
addr ^
then perform
mprotect(addr, len, PROT_WRITE | PROT_READ);
This will return -1, with EPERM, when it encounters the sealed region.
I believe in Linux, since it has not checked for errors as a first
phase, this changes the first region of memory to PROT_READ |
PROT_WRITE. Liam, is that correct? If I am correct, then this
follows:
So tell me -- did the mprotect() system call succeed or did not it
succeed?
If EPERM means it did not succeed, then why is the first region now
writable?
Immediately after this "call that failed", the process can perform a
write to that first region. But no succesful system call was made to
change that memory to PROT_WRITE.
Alternatively, does EPERM mean it did not completely fail, and therefore
it is OK that that the prot value has been applied? That's really obscure,
and undocumented.
In any case it seems, PROT_WRITE can be set on memory, and it is even
more pointless than before for userland to check the errno *because you
can't determine the resulting protection on every page of memory. It's
all a mishmash after that.
(There is no POSIX system call to ask "what is the permission of a page or
region).
> Theo, you're making shit up.
I'm trying to have a technical discussion. Please change your approach,
Linus.
