linux-hardening - [RFC PATCH v5 5/7] mseal, system mappings: enable uml architecture

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250212032155.1276806-6-jeffxu@google.com>
Date: Wed, 12 Feb 2025 03:21:53 +0000
From: jeffxu@...omium.org
To: akpm@...ux-foundation.org,
	keescook@...omium.org,
	jannh@...gle.com,
	torvalds@...ux-foundation.org,
	vbabka@...e.cz,
	lorenzo.stoakes@...cle.com,
	Liam.Howlett@...cle.com,
	adhemerval.zanella@...aro.org,
	oleg@...hat.com,
	avagin@...il.com,
	benjamin@...solutions.net
Cc: linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org,
	linux-mm@...ck.org,
	jorgelo@...omium.org,
	sroettger@...gle.com,
	hch@....de,
	ojeda@...nel.org,
	thomas.weissschuh@...utronix.de,
	adobriyan@...il.com,
	johannes@...solutions.net,
	pedro.falcato@...il.com,
	hca@...ux.ibm.com,
	willy@...radead.org,
	anna-maria@...utronix.de,
	mark.rutland@....com,
	linus.walleij@...aro.org,
	Jason@...c4.com,
	deller@....de,
	rdunlap@...radead.org,
	davem@...emloft.net,
	peterx@...hat.com,
	f.fainelli@...il.com,
	gerg@...nel.org,
	dave.hansen@...ux.intel.com,
	mingo@...nel.org,
	ardb@...nel.org,
	mhocko@...e.com,
	42.hyeyoo@...il.com,
	peterz@...radead.org,
	ardb@...gle.com,
	enh@...gle.com,
	rientjes@...gle.com,
	groeck@...omium.org,
	mpe@...erman.id.au,
	aleksandr.mikhalitsyn@...onical.com,
	mike.rapoport@...il.com,
	Jeff Xu <jeffxu@...omium.org>,
	Benjamin Berg <benjamin.berg@...el.com>
Subject: [RFC PATCH v5 5/7] mseal, system mappings: enable uml architecture

From: Jeff Xu <jeffxu@...omium.org>

Provide support for CONFIG_MSEAL_SYSTEM_MAPPINGS on UML, covering
the vdso.

Testing passes on UML.

Signed-off-by: Jeff Xu <jeffxu@...omium.org>
Tested-by: Benjamin Berg <benjamin.berg@...el.com>
---
 arch/um/Kconfig        | 1 +
 arch/x86/um/vdso/vma.c | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 18051b1cfce0..eb2d439a5334 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -10,6 +10,7 @@ config UML
 	select ARCH_HAS_FORTIFY_SOURCE
 	select ARCH_HAS_GCOV_PROFILE_ALL
 	select ARCH_HAS_KCOV
+	select ARCH_HAS_MSEAL_SYSTEM_MAPPINGS
 	select ARCH_HAS_STRNCPY_FROM_USER
 	select ARCH_HAS_STRNLEN_USER
 	select HAVE_ARCH_AUDITSYSCALL
diff --git a/arch/x86/um/vdso/vma.c b/arch/x86/um/vdso/vma.c
index f238f7b33cdd..a68919db0ff7 100644
--- a/arch/x86/um/vdso/vma.c
+++ b/arch/x86/um/vdso/vma.c
@@ -6,6 +6,7 @@
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/userprocess.h>
 #include <asm/page.h>
 #include <asm/elf.h>
 #include <linux/init.h>
@@ -54,6 +55,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 {
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
+	unsigned long vm_flags;
 	static struct vm_special_mapping vdso_mapping = {
 		.name = "[vdso]",
 	};
@@ -65,9 +67,10 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 		return -EINTR;
 
 	vdso_mapping.pages = vdsop;
+	vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC;
+	vm_flags |= mseal_system_mappings();
 	vma = _install_special_mapping(mm, um_vdso_addr, PAGE_SIZE,
-		VM_READ|VM_EXEC|
-		VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
+		vm_flags,
 		&vdso_mapping);
 
 	mmap_write_unlock(mm);
-- 
2.48.1.502.g6dc24dfdaf-goog