* jeffxu@xxxxxxxxxxxx <jeffxu@xxxxxxxxxxxx> [250224 12:45]: > From: Jeff Xu <jeffxu@xxxxxxxxxxxx> > > Update memory sealing documentation to include details about system > mappings. > > Signed-off-by: Jeff Xu <jeffxu@xxxxxxxxxxxx> > --- > Documentation/userspace-api/mseal.rst | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst > index 41102f74c5e2..10147281bf2d 100644 > --- a/Documentation/userspace-api/mseal.rst > +++ b/Documentation/userspace-api/mseal.rst > @@ -130,6 +130,13 @@ Use cases > > - Chrome browser: protect some security sensitive data structures. Did you mean to drop this line? > > +- System mappings: > + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS), > + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar, > + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are > + known to relocate or unmap system mapping, therefore this config can't be > + enabled universally. > + > When not to use mseal > ===================== > Applications can apply sealing to any virtual memory region from userspace, > -- > 2.48.1.601.g30ceb7b040-goog >
