From patchwork Mon May 13 19:15:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= X-Patchwork-Id: 13663644 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97A9CC25B10 for ; Mon, 13 May 2024 19:16:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id ED6896B02B5; Mon, 13 May 2024 15:16:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E86036B02CF; Mon, 13 May 2024 15:16:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D9B856B02D0; Mon, 13 May 2024 15:16:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id B6F756B02B5 for ; Mon, 13 May 2024 15:16:00 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 5F4D8A0FAC for ; Mon, 13 May 2024 19:16:00 +0000 (UTC) X-FDA: 82114327680.30.2D15D70 Received: from mail-4316.protonmail.ch (mail-4316.protonmail.ch [185.70.43.16]) by imf05.hostedemail.com (Postfix) with ESMTP id 8F082100011 for ; Mon, 13 May 2024 19:15:58 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=protonmail.com header.s=protonmail3 header.b=paUo6HvC; spf=pass (imf05.hostedemail.com: domain of pobrn@protonmail.com designates 185.70.43.16 as permitted sender) smtp.mailfrom=pobrn@protonmail.com; dmarc=pass (policy=quarantine) header.from=protonmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1715627758; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=dnjH8R0E9R4kgtyNo0zRZg9A30KPJQ23f20lyVjqLUg=; b=BpSnrHPV3kaBU/BdD0fnzL3y0oFv0qL6Yo/LSZ1EsKjKYqlQem3rt+BsRRt4wCWyisG9nz G7WpMFrLhDrZXxZmJaAT+fq+ZFcSyDjve7WE1xbW4zmp6hLX642mrgaiV1vG6ybCWkCDNY /ZOA3JO/cD+f9GZvfgYoTKCP57UdPhU= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1715627758; a=rsa-sha256; cv=none; b=7XzLPXvFODDNTOCRN+RkjzLXx7eUIPM3d5KED447d20nAbiqAItDX1YvHA0XDi8BYLSKEV ogtLzVMAZ9aHVnzfM9IDJXvgwsJpaDUKMd/QyhN+Zvh8YXgylhorqbzGQ6l1XPXDQUyZF0 aLnUKcup1yvfofwwaKKBf2owQcA9dD4= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=protonmail.com header.s=protonmail3 header.b=paUo6HvC; spf=pass (imf05.hostedemail.com: domain of pobrn@protonmail.com designates 185.70.43.16 as permitted sender) smtp.mailfrom=pobrn@protonmail.com; dmarc=pass (policy=quarantine) header.from=protonmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1715627756; x=1715886956; bh=dnjH8R0E9R4kgtyNo0zRZg9A30KPJQ23f20lyVjqLUg=; h=Date:To:From:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=paUo6HvCMLe0YNG7ppE6+OPvGgid8o+AocVm7IAPnTOOrvFA/8N/tGUWjA2zzNR1c GVx7xT77FF6o+JP6+Zh09H3imzNnz4rQhZagjM1M4nrgThGaih72r6wrtOP2kNxl1N DHbwRXhrAulrtdz47x25GKugAUt/IFC4+3U0hkAal6Rsx3QureSft5H303iwrUXdAZ 2d1HKUW2K6Qb8kG8VCuE3vE68ZJkRpggJJeRMvYUA1o6wPDzzN/Xw3TwTFvAZ09tQI fER0eEvBGTX1P0vNjY9qTuqab6A7AQNHppc7siqrvJvq4Vy0zENWkFww/RnFLoYQde aPh/FMAymeUSw== Date: Mon, 13 May 2024 19:15:47 +0000 To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, akpm@linux-foundation.org, dmitry.torokhov@gmail.com, dverkamp@chromium.org, hughd@google.com, jeffxu@google.com, jorgelo@chromium.org, skhan@linuxfoundation.org, keescook@chromium.org From: =?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= Subject: [PATCH v1] memfd: `MFD_NOEXEC_SEAL` should not imply `MFD_ALLOW_SEALING` Message-ID: <20240513191544.94754-1-pobrn@protonmail.com> Feedback-ID: 20568564:user:proton X-Pm-Message-ID: 67eeb4ec5ac3eaf815ed12f6c17c9a0732f87faa MIME-Version: 1.0 X-Rspam-User: X-Stat-Signature: hqotaafhpcpr5nncf1rffzifcp1wn1pp X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 8F082100011 X-HE-Tag: 1715627758-874509 X-HE-Meta: U2FsdGVkX1+cxlIRAnAGTt2gPTTQPTzgTWkxzJhVyvxFezzem8a58ro4Euk3SXL2gy0/LEfbgD+L/WDDcBlF6Lq6Smf+JHr9Nt/zYbWLpvBO5/mKM5rZxfxv40nyAVJTzCs2SbwiNUVvolZT6bvMoNNEiw///6HFju4mmm52dbRMMCeUtSqQ6jeafk8htQRrHJEFGM3QRoawka0IxFzdID2po+0/ch3/x9szQscgVVn4cXNjXNVph2AEyYkxZ3OkMiryh5SRVjAcm120rYuAoyHbZM5bvVTnGtW16W6ejjOCvdchP81uOGi+zeJJ+3w6jfaJbsyJe/aV0/qt9fIbqOVX6hky1jd0N2eo9YuGcLfNF9EWhxlmQij7e02ZdcRxrZHMiMl6v9E18jfVpXmzZcXbL3PDRFGQiSYsaGns+dCEBwYPDSMbTZtOKKESWKsVn3OTC0mC0Ui16FQ/8dWmyBGR0qVYCgN00/eanUp4RaMokvyqlSTEkm9U07Z+V4OHVl2Kelb5pi3P395KA9W1Dk13p7hSjqeA3hjp+EGSAzGOkK3CeiD1sT+I3/JW//9Kd4YRKuFdqSjfhGGq6/swNOX4l5rVhV8TC0b64ScnXi/gMNaO3cGByMC2vVLc89pCkZkbsbVk5i9vHQSn46UNS+qsAkXz7kPW91z3JnO6Klwc1cB55FpVoIbcYPOhk1WmSkAZf24IGjU169XgljsOaywvq6uNVHcqkUpo5VGdXHuhtv3gCvyU3UalNi31VcP1Aa8CTQ1mxQwelnm5tVb4A8nKrWiD4TypgHQcRtsBKFyuEvgL4PfdVkHH5ZCKNZDZwteES9btAyZ0m3t4NzOuP8s7YT4+NefDL/X6vwaN1xEfbMUOUwA6HLAvRWNLyFaFVOzeNSUoQT0Qv84ltt3+9Q/TVauci5fonq0RFYx+YXG/FrHh8vdbVHqBbajc/E5Qkem7W/eURVi0cQOZrfx SU0SzB7q OqkES/4IF4pZNYF6M4azd4Ub/r2c3rRUrDoQBxEO778+/esAhfsI7aPCnuxXmR9PvVXN+Gd0gcagssYkbMDoTKKctcmsEqNj3/3+qja7nm3668ybcEXHtsxPvz+PKXlT2I2Vd7qh79CgE8yG3u98LHleYbJ/DVKS37aBx8YPz0JeiO+3kqtajvMy5x+tdnwLV3yLuNuBX+CBguqGNpX2G8+ERXNM5zRhvtctBelgqBFt5hhPOkAWjaUqQE5yoSJxCGdbHEcUJmAPJ7SHVeefrxSilfh5rSLxhFbNGWPhxQcCc4Fyy3xIRB4R05w7CQgm+hgHSYKV11b3vzPeKBPxuCn024fElKuhk5QhXdsXFl459CngdpPwxA8MpseLOrbnB6AWw8OVZ8S5kPDelzziQcR5mXKD6cuf20FkLbGIDu5G5+BE9tvnTh+K1CZ69dHJ0K+h9ZoFfoXCMok3d5QFkZJ/idpblBz7WYKYVsNz4LHj2CSCsvHFn79JyuGLxNANqJBY+mngkNu9nx+0= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: `MFD_NOEXEC_SEAL` should remove the executable bits and set `F_SEAL_EXEC` to prevent further modifications to the executable bits as per the comment in the uapi header file: not executable and sealed to prevent changing to executable However, currently, it also unsets `F_SEAL_SEAL`, essentially acting as a superset of `MFD_ALLOW_SEALING`. Nothing implies that it should be so, and indeed up until the second version of the of the patchset[0] that introduced `MFD_EXEC` and `MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not removed, however it was changed in the third revision of the patchset[1] without a clear explanation. This behaviour is suprising for application developers, there is no documentation that would reveal that `MFD_NOEXEC_SEAL` has the additional effect of `MFD_ALLOW_SEALING`. So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested. This is technically an ABI break, but it seems very unlikely that an application would depend on this behaviour (unless by accident). [0]: https://lore.kernel.org/lkml/20220805222126.142525-3-jeffxu@google.com/ [1]: https://lore.kernel.org/lkml/20221202013404.163143-3-jeffxu@google.com/ Fixes: 105ff5339f498a ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC") Signed-off-by: Barnabás Pőcze Reviewed-by: Jeff Xu Reviewed-by: David Rheinsberg Signed-off-by: Barnabás Pőcze Reviewed-by: Jeff Xu Reviewed-by: David Rheinsberg --- Or did I miss the explanation as to why MFD_NOEXEC_SEAL should imply MFD_ALLOW_SEALING? If so, please direct me to it and sorry for the noise. --- mm/memfd.c | 9 ++++----- tools/testing/selftests/memfd/memfd_test.c | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/mm/memfd.c b/mm/memfd.c index 7d8d3ab3fa37..8b7f6afee21d 100644 --- a/mm/memfd.c +++ b/mm/memfd.c @@ -356,12 +356,11 @@ SYSCALL_DEFINE2(memfd_create, inode->i_mode &= ~0111; file_seals = memfd_file_seals_ptr(file); - if (file_seals) { - *file_seals &= ~F_SEAL_SEAL; + if (file_seals) *file_seals |= F_SEAL_EXEC; - } - } else if (flags & MFD_ALLOW_SEALING) { - /* MFD_EXEC and MFD_ALLOW_SEALING are set */ + } + + if (flags & MFD_ALLOW_SEALING) { file_seals = memfd_file_seals_ptr(file); if (file_seals) *file_seals &= ~F_SEAL_SEAL; diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c index 18f585684e20..b6a7ad68c3c1 100644 --- a/tools/testing/selftests/memfd/memfd_test.c +++ b/tools/testing/selftests/memfd/memfd_test.c @@ -1151,7 +1151,7 @@ static void test_noexec_seal(void) mfd_def_size, MFD_CLOEXEC | MFD_NOEXEC_SEAL); mfd_assert_mode(fd, 0666); - mfd_assert_has_seals(fd, F_SEAL_EXEC); + mfd_assert_has_seals(fd, F_SEAL_SEAL | F_SEAL_EXEC); mfd_fail_chmod(fd, 0777); close(fd); }