2024. június 14., péntek 20:27 keltezéssel, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> írta: > The quilt patch titled > Subject: memfd: `MFD_NOEXEC_SEAL` should not imply `MFD_ALLOW_SEALING` > has been removed from the -mm tree. Its filename was > memfd-mfd_noexec_seal-should-not-imply-mfd_allow_sealing.patch > > This patch was dropped because it was nacked Hi Andrew, do I gather it correctly that this is the final decision, and there is not much willingness to try to remove this quirk of the `memfd_create()`? As far as I can tell, the change was in linux-next for some time, did that uncover any problems? (If so, I haven't been notified.) Anyways, I believe I have laid out my arguments already, so I won't repeat them here, and if this is final, then I will stop wasting everyone's time with further emails. :-) Regards, Barnabás Pőcze > > ------------------------------------------------------ > From: Barnabás Pőcze <pobrn@xxxxxxxxxxxxxx> > Subject: memfd: `MFD_NOEXEC_SEAL` should not imply `MFD_ALLOW_SEALING` > Date: Mon, 13 May 2024 19:15:47 +0000 > > `MFD_NOEXEC_SEAL` should remove the executable bits and set `F_SEAL_EXEC` > to prevent further modifications to the executable bits as per the comment > in the uapi header file: > > not executable and sealed to prevent changing to executable > > However, currently, it also unsets `F_SEAL_SEAL`, essentially acting as a > superset of `MFD_ALLOW_SEALING`. Nothing implies that it should be so, > and indeed up until the second version of the of the patchset[0] that > introduced `MFD_EXEC` and `MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not > removed, however it was changed in the third revision of the patchset[1] > without a clear explanation. > > This behaviour is suprising for application developers, there is no > documentation that would reveal that `MFD_NOEXEC_SEAL` has the additional > effect of `MFD_ALLOW_SEALING`. > > So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested. This > is technically an ABI break, but it seems very unlikely that an > application would depend on this behaviour (unless by accident). > > [0]: https://lore.kernel.org/lkml/20220805222126.142525-3-jeffxu@xxxxxxxxxx/ > [1]: https://lore.kernel.org/lkml/20221202013404.163143-3-jeffxu@xxxxxxxxxx/ > > Link: https://lkml.kernel.org/r/20240513191544.94754-1-pobrn@xxxxxxxxxxxxxx > Fixes: 105ff5339f49 ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC") > Signed-off-by: Barnabás Pőcze <pobrn@xxxxxxxxxxxxxx> > Reviewed-by: Jeff Xu <jeffxu@xxxxxxxxxx> > Reviewed-by: David Rheinsberg <david@xxxxxxxxxxxx> > Cc: Daniel Verkamp <dverkamp@xxxxxxxxxxxx> > Cc: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> > Cc: Hugh Dickins <hughd@xxxxxxxxxx> > Cc: Jeff Xu <jeffxu@xxxxxxxxxx> > Cc: Jorge Lucangeli Obes <jorgelo@xxxxxxxxxxxx> > Cc: Kees Cook <keescook@xxxxxxxxxxxx> > Cc: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > --- > > mm/memfd.c | 9 ++++----- > tools/testing/selftests/memfd/memfd_test.c | 2 +- > 2 files changed, 5 insertions(+), 6 deletions(-) > > --- a/mm/memfd.c~memfd-mfd_noexec_seal-should-not-imply-mfd_allow_sealing > +++ a/mm/memfd.c > @@ -356,12 +356,11 @@ SYSCALL_DEFINE2(memfd_create, > > inode->i_mode &= ~0111; > file_seals = memfd_file_seals_ptr(file); > - if (file_seals) { > - *file_seals &= ~F_SEAL_SEAL; > + if (file_seals) > *file_seals |= F_SEAL_EXEC; > - } > - } else if (flags & MFD_ALLOW_SEALING) { > - /* MFD_EXEC and MFD_ALLOW_SEALING are set */ > + } > + > + if (flags & MFD_ALLOW_SEALING) { > file_seals = memfd_file_seals_ptr(file); > if (file_seals) > *file_seals &= ~F_SEAL_SEAL; > --- a/tools/testing/selftests/memfd/memfd_test.c~memfd-mfd_noexec_seal-should-not-imply-mfd_allow_sealing > +++ a/tools/testing/selftests/memfd/memfd_test.c > @@ -1151,7 +1151,7 @@ static void test_noexec_seal(void) > mfd_def_size, > MFD_CLOEXEC | MFD_NOEXEC_SEAL); > mfd_assert_mode(fd, 0666); > - mfd_assert_has_seals(fd, F_SEAL_EXEC); > + mfd_assert_has_seals(fd, F_SEAL_SEAL | F_SEAL_EXEC); > mfd_fail_chmod(fd, 0777); > close(fd); > } > _ > > Patches currently in -mm which might be from pobrn@xxxxxxxxxxxxxx are
