On Mon, May 13, 2024 at 12:15 PM Barnabás Pőcze <pobrn@xxxxxxxxxxxxxx> wrote: > > `MFD_NOEXEC_SEAL` should remove the executable bits and set > `F_SEAL_EXEC` to prevent further modifications to the executable > bits as per the comment in the uapi header file: > > not executable and sealed to prevent changing to executable > > However, currently, it also unsets `F_SEAL_SEAL`, essentially > acting as a superset of `MFD_ALLOW_SEALING`. Nothing implies > that it should be so, and indeed up until the second version > of the of the patchset[0] that introduced `MFD_EXEC` and > `MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not removed, however it > was changed in the third revision of the patchset[1] without > a clear explanation. > > This behaviour is suprising for application developers, > there is no documentation that would reveal that `MFD_NOEXEC_SEAL` > has the additional effect of `MFD_ALLOW_SEALING`. > Ya, I agree that there should be documentation, such as a man page. I will work on that. > So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested. > This is technically an ABI break, but it seems very unlikely that an > application would depend on this behaviour (unless by accident). > > [0]: https://lore.kernel.org/lkml/20220805222126.142525-3-jeffxu@xxxxxxxxxx/ > [1]: https://lore.kernel.org/lkml/20221202013404.163143-3-jeffxu@xxxxxxxxxx/ > > Fixes: 105ff5339f498a ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC") > Signed-off-by: Barnabás Pőcze <pobrn@xxxxxxxxxxxxxx> > --- > > Or did I miss the explanation as to why MFD_NOEXEC_SEAL should > imply MFD_ALLOW_SEALING? If so, please direct me to it and > sorry for the noise. > Previously I might be thinking MFD_NOEXEC_SEAL implies MFD_ALLOW_SEALING because MFD_NOEXEC_SEAL seals F_SEAL_EXEC, and sealing is added only when MFD_ALLOW_SEALING is set. I agree your patch handles this better, e.g. mfd_create(MFD_NOEXEC_SEAL) will have F_SEAL_SEAL and F_SEAL_EXEC mfd_create(MFD_NOEXEC_SEAL|MFD_ALLOW_SEALING) will have F_SEAL_EXEC > --- > mm/memfd.c | 9 ++++----- > tools/testing/selftests/memfd/memfd_test.c | 2 +- > 2 files changed, 5 insertions(+), 6 deletions(-) > > diff --git a/mm/memfd.c b/mm/memfd.c > index 7d8d3ab3fa37..8b7f6afee21d 100644 > --- a/mm/memfd.c > +++ b/mm/memfd.c > @@ -356,12 +356,11 @@ SYSCALL_DEFINE2(memfd_create, > > inode->i_mode &= ~0111; > file_seals = memfd_file_seals_ptr(file); > - if (file_seals) { > - *file_seals &= ~F_SEAL_SEAL; > + if (file_seals) > *file_seals |= F_SEAL_EXEC; > - } > - } else if (flags & MFD_ALLOW_SEALING) { > - /* MFD_EXEC and MFD_ALLOW_SEALING are set */ > + } > + > + if (flags & MFD_ALLOW_SEALING) { > file_seals = memfd_file_seals_ptr(file); > if (file_seals) > *file_seals &= ~F_SEAL_SEAL; > diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c > index 18f585684e20..b6a7ad68c3c1 100644 > --- a/tools/testing/selftests/memfd/memfd_test.c > +++ b/tools/testing/selftests/memfd/memfd_test.c > @@ -1151,7 +1151,7 @@ static void test_noexec_seal(void) > mfd_def_size, > MFD_CLOEXEC | MFD_NOEXEC_SEAL); > mfd_assert_mode(fd, 0666); > - mfd_assert_has_seals(fd, F_SEAL_EXEC); > + mfd_assert_has_seals(fd, F_SEAL_SEAL | F_SEAL_EXEC); > mfd_fail_chmod(fd, 0777); > close(fd); > } > -- > 2.45.0 > Reviewed-by: Jeff Xu <jeffxu@xxxxxxxxxx> Thanks! -Jeff
