From patchwork Wed Oct 26 15:04:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joey Gouly X-Patchwork-Id: 13020747 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 80DC8C433FE for ; Wed, 26 Oct 2022 15:10:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=ZHYz0Mz4AVWjo4CjphjV1v6BLnxHuwMXHv21+SLSC+w=; b=AiqcwFKZthTlzD xNhRQcXH00SAxf3xaZukpymvqj9Q2sc6MWaNBA+XKLuk33t7kTo9+vsY5lp1Q9oTLZHI187Wt5OHA Zq4CdHFU4cjxCTBn9rDfUXqoc48J1yMssucxSaSraNmqHYVtc4lzqMO5+PAJtpscUiuATa1wxPJ+A tdUkTYvH4EVrNQIQx2y89FTmtNbsi9fXayakSuBH6EToIGiXJEvUebWRc9muwunWP5DHSxDyeLBST urXlwHA2eq4L/jL5ZKh+rCR3kEtrmmALS3WYshvXn+e6A42b0jj4VsjHYTybt+4YRAP2BBA6tvaAM C64kj50SwYL5EUqY8xzg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oni1F-009oik-UF; Wed, 26 Oct 2022 15:08:38 +0000 Received: from mail-db8eur05on2074.outbound.protection.outlook.com ([40.107.20.74] helo=EUR05-DB8-obe.outbound.protection.outlook.com) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oni1C-009ohR-Iq for linux-arm-kernel@lists.infradead.org; Wed, 26 Oct 2022 15:08:36 +0000 ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=KmZKCZ7sc0B2OQk8g8zGsOkMLZMmxfurMBFtEt/RmiO6kelIbPb2LYAcb2oW73ZroUiUTw+lcJd8LvASD7Qbr21jcTvCCq0ISqukNn9s3f6o6jY4h10uzz7BciDvZg5d3OupqPS/BMYKw1sH/YXUDLuRiykLlkhky1W7L38IyaHtaQ5JITGsiWHMXzo8SVVqFk90/Ub8dyWEEEOqH3CMT7Kz/PVwcd6rujPrkgf729a02UQ025er0+MKhwf3P1NM6OGZfJ2V1P4quCHfqNLOl/pOgd81S66CZrI+Ron4F2im0ArcXmjUYx6rwzv/IEMCd0BdX+bm1EWQBKkEAjnHgg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BSROhHN+ILW5PCl2wDM9wNCCF0OA08XemKwknaWV3Dk=; b=T8Ohkce500OyHu/mD99W7BVQcchKz3BWtH0J5y268rOk/thE8JdztNEzeR0ydbROBBjuDFQb/2DdUAj4GtdcvE6AdUMApmduGhj8078e2YlRR5h23/QdtjZDScY8nscXDJhOBCnQbFB7eOle1CigTfq9qr3hZvvBQrcsQ/tnGbhHJFpRR7n54QhcxnZOjl/v0GFWo8q9YkBcAOrCFqAXbgmHjLGFXWaWbNqMpYYQly4+DYIjbLXoAqjVqPSXN6l9a0+mhhQIw1xfm20Z794oV9Bi+aVGnLdcm7nALk6FiJCPwYkFmFn0hF1FNH2w1pOGstXQgi9UT0t9Yi03Fp7Hfw== ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 63.35.35.123) smtp.rcpttodomain=lists.infradead.org smtp.mailfrom=arm.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com; arc=pass (0 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=arm.com] dmarc=[1,1,header.from=arm.com]) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BSROhHN+ILW5PCl2wDM9wNCCF0OA08XemKwknaWV3Dk=; b=1KYUW+i53iu0xV27Ze8kFHqqzv8UQ7bSk1uJfQg6m/yenIsLOmTxILTc1l483j/afFwxT69xuFUqKrbf95yQh7U0O7RhLepQns5VzhnDJyAPcJ5+fUJ5ef7YcMLfbsaByDx3AZqndVsgncNvq40vVx8Yd1NfnU7RWWVzWBsl7Sc= Received: from DB7PR05CA0046.eurprd05.prod.outlook.com (2603:10a6:10:2e::23) by DB9PR08MB8580.eurprd08.prod.outlook.com (2603:10a6:10:3d3::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5746.21; Wed, 26 Oct 2022 15:08:29 +0000 Received: from DBAEUR03FT025.eop-EUR03.prod.protection.outlook.com (2603:10a6:10:2e:cafe::cc) by DB7PR05CA0046.outlook.office365.com (2603:10a6:10:2e::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5746.21 via Frontend Transport; Wed, 26 Oct 2022 15:08:29 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; pr=C Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DBAEUR03FT025.mail.protection.outlook.com (100.127.142.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5709.10 via Frontend Transport; Wed, 26 Oct 2022 15:08:29 +0000 Received: ("Tessian outbound f394866f3f2b:v130"); Wed, 26 Oct 2022 15:08:28 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 94ef1b3d8371e5d4 X-CR-MTA-TID: 64aa7808 Received: from 90cc8d6c0469.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 4D72F77C-E526-4381-82D7-EE6053881968.1; Wed, 26 Oct 2022 15:05:18 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 90cc8d6c0469.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 26 Oct 2022 15:05:18 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XkjhuQLOkW26dyKvTxbcZMPGZhux8PbFSA/DjwnDg1XsdbbBWNTmrklWGEQHrn5k62DzDoLjuT93f8iyQIrfQkc8IUIe8g3QfZn4QW6uEVeCBsGWcmj3NI+CX6ydgVFwKyRY6PoV/ltae7jR/2XT1wDULwlwbOGwateICW1eks2PSdEVmUoYoJuHo8oMcVwoAueeXc1xgbay0Vo8Y2G2OSLvL1AALZzZEJgC16DhnJT3+I5xYPGAR/8c6DTnkGFJ8p+5aIhhzVLqO6sQEmXNOcRHZJLKYmmbUC4DDFnwf4HVIZooE1iOEUXBPnmJSapEM/RTRi2InMF5jhDLSLHH1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BSROhHN+ILW5PCl2wDM9wNCCF0OA08XemKwknaWV3Dk=; b=kJnU4TLOU3sDvy9lV1laz4jPogLBBsKMZJqc2bOnoEGiYL+0j7Fko4iXj3fnL351uOZ/siGfATLS8GAmaM+VrqZuyZAnu9w4bKd9v5eKLqokDk4ZWpy5at2qUPDnEZ2fK8aXoUfZkBTv+CHjW9gttntiNQeT8Lb4MsyLeAsiSjVK3NzpIDhHHdxsRxUzCUHdU1XQl4CKcSCW0XT24G/g9m0w5E73H5tJwNhcSzf3+198kloUyPTIySwYjLj7EibzzFTuTHXbdKRJ179onwLyfpOrsGEZx9JlrS/dQ0hNQXNv656Ea/ldQunfcCExJHFycVh0AuIUv2EEAKRvrwxkhA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 40.67.248.234) smtp.rcpttodomain=linux-foundation.org smtp.mailfrom=arm.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=arm.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BSROhHN+ILW5PCl2wDM9wNCCF0OA08XemKwknaWV3Dk=; b=1KYUW+i53iu0xV27Ze8kFHqqzv8UQ7bSk1uJfQg6m/yenIsLOmTxILTc1l483j/afFwxT69xuFUqKrbf95yQh7U0O7RhLepQns5VzhnDJyAPcJ5+fUJ5ef7YcMLfbsaByDx3AZqndVsgncNvq40vVx8Yd1NfnU7RWWVzWBsl7Sc= Received: from DB6PR0501CA0017.eurprd05.prod.outlook.com (2603:10a6:4:8f::27) by AS8PR08MB5974.eurprd08.prod.outlook.com (2603:10a6:20b:298::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5746.28; Wed, 26 Oct 2022 15:05:16 +0000 Received: from DBAEUR03FT020.eop-EUR03.prod.protection.outlook.com (2603:10a6:4:8f:cafe::75) by DB6PR0501CA0017.outlook.office365.com (2603:10a6:4:8f::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5723.30 via Frontend Transport; Wed, 26 Oct 2022 15:05:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 40.67.248.234) smtp.mailfrom=arm.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 40.67.248.234 as permitted sender) receiver=protection.outlook.com; client-ip=40.67.248.234; helo=nebula.arm.com; pr=C Received: from nebula.arm.com (40.67.248.234) by DBAEUR03FT020.mail.protection.outlook.com (100.127.143.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5769.14 via Frontend Transport; Wed, 26 Oct 2022 15:05:15 +0000 Received: from AZ-NEU-EX02.Emea.Arm.com (10.251.26.5) by AZ-NEU-EX04.Arm.com (10.251.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.12; Wed, 26 Oct 2022 15:05:15 +0000 Received: from AZ-NEU-EX03.Arm.com (10.251.24.31) by AZ-NEU-EX02.Emea.Arm.com (10.251.26.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.12; Wed, 26 Oct 2022 15:05:15 +0000 Received: from e124191.cambridge.arm.com (10.1.197.45) by mail.arm.com (10.251.24.31) with Microsoft SMTP Server id 15.1.2507.12 via Frontend Transport; Wed, 26 Oct 2022 15:05:14 +0000 From: Joey Gouly To: Catalin Marinas , Andrew Morton , Lennart Poettering , =?utf-8?q?Zbigniew_J=C4=99drze?= =?utf-8?q?jewski-Szmek?= CC: Alexander Viro , Kees Cook , Szabolcs Nagy , Mark Brown , Jeremy Linton , Topi Miettinen , , , , , , , Subject: [PATCH v1 0/2] mm: In-kernel support for memory-deny-write-execute (MDWE) Date: Wed, 26 Oct 2022 16:04:55 +0100 Message-ID: <20221026150457.36957-1-joey.gouly@arm.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-EOPAttributedMessage: 1 X-MS-TrafficTypeDiagnostic: DBAEUR03FT020:EE_|AS8PR08MB5974:EE_|DBAEUR03FT025:EE_|DB9PR08MB8580:EE_ X-MS-Office365-Filtering-Correlation-Id: 4030989a-bb7a-4f20-7f50-08dab763f091 x-checkrecipientrouted: true NoDisclaimer: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: OJ0tWd0jGXCt6Vsu2MsRJPz5IB/Wd5mNXe09jlXyMjJMXg966b/fWOjJBnSfJR+y8rn5z4wHz6BhKJQD30wDSdZmJrIEKOFOBM8aT6CKkVUFyIIzqElosDM2LznIKRWgM2MAdrzBibpMVQ5inlyBL8nBqaqcDcR6yEhpvkDXuarI5IarkvCaZpPvSD1RtY4Q0BOB6fXPrwPBhLfin7D8uenNlYDSZnmX2OHRXwsZ/4u3af3PGu5FLt3EAaT4QUXE1LH1N8z+8b3KZv+wZcAOsau+Arw2hGaBAGlht8C3DgXwWpc4cwf/avdaIRwz5vK6FSGmxUIhKibwU+fxn4I6VeDf0Hz04efGJJ+TSl1iL4MQGLi2OHLk17cJcTPXFChjtTf1AMiA1M2C+Nwnuw5XnmLtxaW9SUSfS/Xdrr6oYll55KJ+JG7giRdmorhmQADPdlKD3mmdTiPn51uUT0h1kV/DXFrVgJa0PWuRjcA/j9kJDhjIVD6wZxjh1KjSs4G46ZBWYIvTV/yS3LAJsGrreJ9pJw/RZPcg+q7xjbuoixPgsoWmvpZhMfVFGWvXuv+yT/unYJpAC/Hi1c40vUEK+4YPv22yjWPC3V6W+jFSRoli4q4K2U4+Rxiq5Wuct19jaqfoFQZmYILGtEuWXOyeU5VKEUufCpZvxnyuurvzi3DvSJaa3kFTmgyRnxVz6NgoN4HVp3j0vJmUxMzcS+4FfdXwPGhtusQ9iQCIBNzHtFUeJf9+jOA7lzgSrTPxaZdYYWhGPCO01WmCl/+unCfNJmgnBzuEsI6YTS/Dw1QMyw/qRApS9MWM/cIOtktFSWyQxiozxY3BMIHJbAETpbm/POqcqnGqGBVypHtneFqsj46m2mbW6XAbKO8YqgluXpqn X-Forefront-Antispam-Report-Untrusted: CIP:40.67.248.234;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:nebula.arm.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230022)(4636009)(396003)(346002)(136003)(376002)(39860400002)(451199015)(40470700004)(36840700001)(46966006)(110136005)(478600001)(36756003)(86362001)(44832011)(2906002)(81166007)(40460700003)(82740400003)(426003)(1076003)(47076005)(186003)(83380400001)(356005)(336012)(6666004)(7696005)(966005)(70586007)(316002)(70206006)(8676002)(4326008)(54906003)(8936002)(5660300002)(36860700001)(41300700001)(82310400005)(7416002)(40480700001)(26005)(2616005)(36900700001);DIR:OUT;SFP:1101; X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB5974 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DBAEUR03FT025.eop-EUR03.prod.protection.outlook.com X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id-Prvs: f6ded434-6ca5-4c7c-5168-08dab7637d63 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BfngfydT//eCSFDWRPSyFgXhfcP+bqPjSEFVFN6L2LrQoMR/ljvEMdvPUITQ5nG/1vOh2csRmGu+lSZBBElfaG2eay2RzJ1GP6jNfR3+DWSvs9+oaGEsUbpSwCKiVm9f1JBRI+xQ5t7j+Ai+1aQ2ZrdyN2mg17Ne288sz0yUzvGSbVx9JNsTBHCDG04U9tqJld8gIsG6Q7rB4ugo2w3sgu8MoSHxYl7/gAK9Veif8Rc3kU0msqiJ6QIcurBaZTgoFitPQEqSc4SsHMMgzBdCGY0sU9DZyle/jK9oA6O3cuOiSoeb4BB7ouYDnpvKQ00VtrUyDYZjo1j/4KAbRryzfY6Y3T5qQFDiZ/oYz6vr88cYLjfv9wh0G6fNsvXKkDB6ewdHs2os6gEy/nh3FcKLg/ko6/cxU+ojVRD/NCRMSjbZnEWu1gwx3bggFrckoI/j9kbpzCNrOLFt8k/dZStP7lTJkO3oOPEx7A28DIKj1AWoGCe0iVtgggT+bpOnuyX2zDv74dOUq5BWHWpqgCFWNAa0Nt4EPINauEG4uPD429d83NrayEw5T3n37zeAdH01V4bl+iMetkpWfzIpyWp1GncGMBBA9YGYCWPbH+LBHrPwwV5HiXDgaZ5cBhRTyqRypFnCFxAK+Uw+bdYCUWtOqzQRVj7cTGvGtULM8rjd2pcO1/p/Ws4asr86FFEIjJeA0Wnee5QwaBugex8fh1rvEYebIzYzo1nTdQiz7W7CXioq2R4IKzlH7Xyt53hxlY6NyEuERechyRRp8o/wD+L1jbqZV+JXxIgBEef4LS43Frmf7XT9+gtntEYW4DQDmeNo6KfIXXVvPGTc+vOSDFwdQQ== X-Forefront-Antispam-Report: CIP:63.35.35.123;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:64aa7808-outbound-1.mta.getcheckrecipient.com;PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com;CAT:NONE;SFS:(13230022)(4636009)(39860400002)(136003)(346002)(376002)(396003)(451199015)(36840700001)(46966006)(40470700004)(316002)(110136005)(478600001)(36860700001)(54906003)(70586007)(4326008)(107886003)(7696005)(8676002)(70206006)(6666004)(966005)(41300700001)(26005)(186003)(426003)(8936002)(2906002)(1076003)(36756003)(44832011)(2616005)(5660300002)(47076005)(83380400001)(40460700003)(81166007)(82740400003)(336012)(40480700001)(82310400005)(86362001);DIR:OUT;SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2022 15:08:29.2058 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4030989a-bb7a-4f20-7f50-08dab763f091 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[63.35.35.123];Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: DBAEUR03FT025.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB8580 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221026_080834_794202_799D6389 X-CRM114-Status: GOOD ( 16.45 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi all, This is a follow up to the RFC that Catalin posted: https://lore.kernel.org/linux-arm-kernel/20220413134946.2732468-1-catalin.marinas@arm.com/ The background to this is that systemd has a configuration option called MemoryDenyWriteExecute [1], implemented as a SECCOMP BPF filter. Its aim is to prevent a user task from inadvertently creating an executable mapping that is (or was) writeable. Since such BPF filter is stateless, it cannot detect mappings that were previously writeable but subsequently changed to read-only. Therefore the filter simply rejects any mprotect(PROT_EXEC). The side-effect is that on arm64 with BTI support (Branch Target Identification), the dynamic loader cannot change an ELF section from PROT_EXEC to PROT_EXEC|PROT_BTI using mprotect(). For libraries, it can resort to unmapping and re-mapping but for the main executable it does not have a file descriptor. The original bug report in the Red Hat bugzilla - [2] - and subsequent glibc workaround for libraries - [3]. This series adds in-kernel support for this feature as a prctl PR_SET_MDWE, that is inherited on fork(). The prctl denies PROT_WRITE | PROT_EXEC mappings. Like the systemd BPF filter it also denies adding PROT_EXEC to mappings. However unlike the BPF filter it only denies it if the mapping didn't previous have PROT_EXEC. This allows to PROT_EXEC -> PROT_EXEC | PROT_BTI with mprotect(), which is a problem with the BPF filter. Thanks, Joey [1] https://www.freedesktop.org/software/systemd/man/systemd.exec.html#MemoryDenyWriteExecute= [2] https://bugzilla.redhat.com/show_bug.cgi?id=1888842 [3] https://sourceware.org/bugzilla/show_bug.cgi?id=26831 Joey Gouly (2): mm: Implement memory-deny-write-execute as a prctl kselftest: vm: add tests for memory-deny-write-execute include/linux/mman.h | 15 ++ include/linux/sched/coredump.h | 6 +- include/uapi/linux/prctl.h | 6 + kernel/sys.c | 18 +++ mm/mmap.c | 3 + mm/mprotect.c | 5 + tools/testing/selftests/vm/mdwe_test.c | 194 +++++++++++++++++++++++++ 7 files changed, 246 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/vm/mdwe_test.c