From patchwork Fri Aug 5 22:21:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 12937865 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A9E6C00140 for ; Fri, 5 Aug 2022 22:21:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0B5306B0071; Fri, 5 Aug 2022 18:21:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 065338E0003; Fri, 5 Aug 2022 18:21:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E6FB98E0002; Fri, 5 Aug 2022 18:21:49 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id D8AC76B0071 for ; Fri, 5 Aug 2022 18:21:49 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 9A0F11C2D04 for ; Fri, 5 Aug 2022 22:21:49 +0000 (UTC) X-FDA: 79766962338.22.921923B Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) by imf19.hostedemail.com (Postfix) with ESMTP id 43BC71A0114 for ; Fri, 5 Aug 2022 22:21:49 +0000 (UTC) Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-31f63772b89so31623417b3.6 for ; Fri, 05 Aug 2022 15:21:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=mbnTnCyzBrPsZ2cIyy/polFSFcHi5iA+y2wZHy5S50g=; b=O1tv2Chuzvi0NDU6zf4N/Fshq6yGCqiuDTuun/edjoU5VnoWU6HlwRqRq214Cym4mz noFPwUsXvo0SYNfeNEjWoXIVZcign3gEgsFpITz4QnZrbGOtKfeY+cDS9TK5falMgCNI DJ6xcL5LbkGOVjDMSML6SM3jRDsvX6GsPMXFLvFKSYD1BtYOfgnhaOBaYbe12JSlISWh zKPVACct5OHq40PuoLQGZTx+YFMcXX1RgsGmCiYPiEbumgKzZ847z4pJf7UeYvrXqLcR FAIEKIHGSOX0P4KPT7WoPV95vsdEH3BO4vgVQ2JI3EeE9rV4Ph0MSuemj+SCfQWNltzS 3OGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=mbnTnCyzBrPsZ2cIyy/polFSFcHi5iA+y2wZHy5S50g=; b=fUPE52xPB9q2x7zqGb7S1X+M07plVaWo3Z0vWB/jYM7sePatURKZEZxAW9BxYjDlDU oVcCyJEUxGPUezMIlnlIcglf0e7uWAmur3QpNO49vk8iB8+keYtUZmA/cQ3n9tPsIagI 9rh7q4GBgXeQswA/jxhdfLzyY9dQCKkio/NLlW+HCqZDUpb80+3fbwAsLWROMXZlY2AK EouSkAiawUptT/EynEl9nFLsTzDf06xtcz8gytg1fcw8y/CMVmLH7YmfCRHvlDhqIwjm 7ePcritBvdATXQzKAWpxZjuwX7H9xETFKbeI3nxpn1dMZMIFjAlxiWeIgq87EhEv3zcF 14uA== X-Gm-Message-State: ACgBeo256QtOFmUL9T2Kpu+/A8j3B6ZviTZ5v+JbZyCEK+ZYL1mwcXh1 0sW4YdueOLcOqKWhe4QIDfAEupHN+HI= X-Google-Smtp-Source: AA6agR6sCneuMkIn8ODRd5RHoaPnFVjTcuaTHnQMf3gsH0n2vQfppBnVbsN+vr+g2fHjPeLdvPi2NkEA0yQ= X-Received: from jeffxud.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:e37]) (user=jeffxu job=sendgmr) by 2002:a05:6902:723:b0:677:115b:553c with SMTP id l3-20020a056902072300b00677115b553cmr7776175ybt.214.1659738108553; Fri, 05 Aug 2022 15:21:48 -0700 (PDT) Date: Fri, 5 Aug 2022 22:21:22 +0000 In-Reply-To: <20220805222126.142525-1-jeffxu@google.com> Message-Id: <20220805222126.142525-2-jeffxu@google.com> Mime-Version: 1.0 References: <20220805222126.142525-1-jeffxu@google.com> X-Mailer: git-send-email 2.37.1.559.g78731f0fdb-goog Subject: [PATCH v2 1/5] mm/memfd: add F_SEAL_EXEC From: To: skhan@linuxfoundation.org Cc: akpm@linux-foundation.org, dmitry.torokhov@gmail.com, dverkamp@chromium.org, hughd@google.com, jeffxu@google.com, jorgelo@chromium.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, mnissler@chromium.org, jannh@google.com, Jeff Xu ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1659738109; a=rsa-sha256; cv=none; b=JIP1OlItHNLwJDhI+daRLJM6wTZphZZoAS43YT9GzwlsahReF6DvqU0yglKmc3ph6U8s4o SosRWaw5uGP8m2LH+RqR+uyKrW/J4u6wGIv8hEyRYOeE2ivjhJE3vmmuvN/fLfOqJyJLLB XuTpUAV+i/wl3LGP8heKI+Ks140d/mE= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=O1tv2Chu; spf=pass (imf19.hostedemail.com: domain of 3_JftYgYKCAEkfggyvhpphmf.dpnmjovy-nnlwbdl.psh@flex--jeffxu.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3_JftYgYKCAEkfggyvhpphmf.dpnmjovy-nnlwbdl.psh@flex--jeffxu.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1659738109; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=mbnTnCyzBrPsZ2cIyy/polFSFcHi5iA+y2wZHy5S50g=; b=iXLD7LRfLDLQRoJYQIdJU0aWqR4EJ2YU+p2p+qeD/O3t82P2Bp6WaqRkbu2hGUs+ifYCGe pu50chuji+XFxmv8L7L+mv7eU8k0XWMUQ+oB135zNIxvYxmCFNBlH8cI+48NFWbIX6j8NZ gOZ824GWkY4kL63rbn56NvqTNzkKv20= X-Stat-Signature: 9zs3wqndjzwmf9xihr1pusx6kx6bch3n X-Rspamd-Queue-Id: 43BC71A0114 Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=O1tv2Chu; spf=pass (imf19.hostedemail.com: domain of 3_JftYgYKCAEkfggyvhpphmf.dpnmjovy-nnlwbdl.psh@flex--jeffxu.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3_JftYgYKCAEkfggyvhpphmf.dpnmjovy-nnlwbdl.psh@flex--jeffxu.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com X-Rspam-User: X-Rspamd-Server: rspam05 X-HE-Tag: 1659738109-38086 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Daniel Verkamp The new F_SEAL_EXEC flag will prevent modification of the exec bits: written as traditional octal mask, 0111, or as named flags, S_IXUSR | S_IXGRP | S_IXOTH. Any chmod(2) or similar call that attempts to modify any of these bits after the seal is applied will fail with errno EPERM. This will preserve the execute bits as they are at the time of sealing, so the memfd will become either permanently executable or permanently un-executable. Co-developed-by: Jeff Xu Signed-off-by: Jeff Xu Signed-off-by: Daniel Verkamp --- include/uapi/linux/fcntl.h | 1 + mm/memfd.c | 2 ++ mm/shmem.c | 6 ++++++ 3 files changed, 9 insertions(+) diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h index 2f86b2ad6d7e..a472ba69596c 100644 --- a/include/uapi/linux/fcntl.h +++ b/include/uapi/linux/fcntl.h @@ -43,6 +43,7 @@ #define F_SEAL_GROW 0x0004 /* prevent file from growing */ #define F_SEAL_WRITE 0x0008 /* prevent writes */ #define F_SEAL_FUTURE_WRITE 0x0010 /* prevent future writes while mapped */ +#define F_SEAL_EXEC 0x0020 /* prevent chmod modifying exec bits */ /* (1U << 31) is reserved for signed error codes */ /* diff --git a/mm/memfd.c b/mm/memfd.c index 08f5f8304746..4ebeab94aa74 100644 --- a/mm/memfd.c +++ b/mm/memfd.c @@ -147,6 +147,7 @@ static unsigned int *memfd_file_seals_ptr(struct file *file) } #define F_ALL_SEALS (F_SEAL_SEAL | \ + F_SEAL_EXEC | \ F_SEAL_SHRINK | \ F_SEAL_GROW | \ F_SEAL_WRITE | \ @@ -175,6 +176,7 @@ static int memfd_add_seals(struct file *file, unsigned int seals) * SEAL_SHRINK: Prevent the file from shrinking * SEAL_GROW: Prevent the file from growing * SEAL_WRITE: Prevent write access to the file + * SEAL_EXEC: Prevent modification of the exec bits in the file mode * * As we don't require any trust relationship between two parties, we * must prevent seals from being removed. Therefore, sealing a file diff --git a/mm/shmem.c b/mm/shmem.c index e5e43b990fdc..bb530f562bdd 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1082,6 +1082,12 @@ static int shmem_setattr(struct user_namespace *mnt_userns, if (error) return error; + if ((info->seals & F_SEAL_EXEC) && (attr->ia_valid & ATTR_MODE)) { + if ((inode->i_mode ^ attr->ia_mode) & 0111) { + return -EPERM; + } + } + if (S_ISREG(inode->i_mode) && (attr->ia_valid & ATTR_SIZE)) { loff_t oldsize = inode->i_size; loff_t newsize = attr->ia_size;