| Message ID | 20250224174513.3600914-8-jeffxu@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | mseal system mappings | expand |
On Mon, Feb 24, 2025 at 05:45:13PM +0000, jeffxu@chromium.org wrote: > From: Jeff Xu <jeffxu@chromium.org> > > Update memory sealing documentation to include details about system > mappings. > > Signed-off-by: Jeff Xu <jeffxu@chromium.org> Thanks, I think the list of programs is good. Reviewed-by: Kees Cook <kees@kernel.org>
* jeffxu@chromium.org <jeffxu@chromium.org> [250224 12:45]: > From: Jeff Xu <jeffxu@chromium.org> > > Update memory sealing documentation to include details about system > mappings. > > Signed-off-by: Jeff Xu <jeffxu@chromium.org> > --- > Documentation/userspace-api/mseal.rst | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst > index 41102f74c5e2..10147281bf2d 100644 > --- a/Documentation/userspace-api/mseal.rst > +++ b/Documentation/userspace-api/mseal.rst > @@ -130,6 +130,13 @@ Use cases > > - Chrome browser: protect some security sensitive data structures. Did you mean to drop this line? > > +- System mappings: > + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS), > + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar, > + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are > + known to relocate or unmap system mapping, therefore this config can't be > + enabled universally. > + > When not to use mseal > ===================== > Applications can apply sealing to any virtual memory region from userspace, > -- > 2.48.1.601.g30ceb7b040-goog >
On Mon, Feb 24, 2025 at 12:26 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote: > > * jeffxu@chromium.org <jeffxu@chromium.org> [250224 12:45]: > > From: Jeff Xu <jeffxu@chromium.org> > > > > Update memory sealing documentation to include details about system > > mappings. > > > > Signed-off-by: Jeff Xu <jeffxu@chromium.org> > > --- > > Documentation/userspace-api/mseal.rst | 7 +++++++ > > 1 file changed, 7 insertions(+) > > > > diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst > > index 41102f74c5e2..10147281bf2d 100644 > > --- a/Documentation/userspace-api/mseal.rst > > +++ b/Documentation/userspace-api/mseal.rst > > @@ -130,6 +130,13 @@ Use cases > > > > - Chrome browser: protect some security sensitive data structures. > > Did you mean to drop this line? > Ah, thank you for catching that. -Jeff > > > > +- System mappings: > > + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS), > > + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar, > > + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are > > + known to relocate or unmap system mapping, therefore this config can't be > > + enabled universally. > > + > > When not to use mseal > > ===================== > > Applications can apply sealing to any virtual memory region from userspace, > > -- > > 2.48.1.601.g30ceb7b040-goog > >
On Mon, Feb 24, 2025 at 1:06 PM Jeff Xu <jeffxu@chromium.org> wrote: > > On Mon, Feb 24, 2025 at 12:26 PM Liam R. Howlett > <Liam.Howlett@oracle.com> wrote: > > > > * jeffxu@chromium.org <jeffxu@chromium.org> [250224 12:45]: > > > From: Jeff Xu <jeffxu@chromium.org> > > > > > > Update memory sealing documentation to include details about system > > > mappings. > > > > > > Signed-off-by: Jeff Xu <jeffxu@chromium.org> > > > --- > > > Documentation/userspace-api/mseal.rst | 7 +++++++ > > > 1 file changed, 7 insertions(+) > > > > > > diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst > > > index 41102f74c5e2..10147281bf2d 100644 > > > --- a/Documentation/userspace-api/mseal.rst > > > +++ b/Documentation/userspace-api/mseal.rst > > > @@ -130,6 +130,13 @@ Use cases > > > > > > - Chrome browser: protect some security sensitive data structures. > > > > Did you mean to drop this line? > > > Ah, thank you for catching that. > Actually, this isn't a problem here. The "-" here is part of the text, for list, so that line is not dropped). -Jeff > -Jeff > > > > > > > > +- System mappings: > > > + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS), > > > + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar, > > > + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are > > > + known to relocate or unmap system mapping, therefore this config can't be > > > + enabled universally. > > > + > > > When not to use mseal > > > ===================== > > > Applications can apply sealing to any virtual memory region from userspace, > > > -- > > > 2.48.1.601.g30ceb7b040-goog > > >
diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst index 41102f74c5e2..10147281bf2d 100644 --- a/Documentation/userspace-api/mseal.rst +++ b/Documentation/userspace-api/mseal.rst @@ -130,6 +130,13 @@ Use cases - Chrome browser: protect some security sensitive data structures. +- System mappings: + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS), + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar, + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are + known to relocate or unmap system mapping, therefore this config can't be + enabled universally. + When not to use mseal ===================== Applications can apply sealing to any virtual memory region from userspace,