linux-kernel - Re: [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181109084928.GA37614@google.com>
Date:   Fri, 9 Nov 2018 00:49:28 -0800
From:   Joel Fernandes <joel@...lfernandes.org>
To:     linux-kernel@...r.kernel.org, hch@...radead.org
Cc:     jreck@...gle.com, john.stultz@...aro.org, tkjos@...gle.com,
        gregkh@...uxfoundation.org, Al Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>, dancol@...gle.com,
        "J. Bruce Fields" <bfields@...ldses.org>,
        Jeff Layton <jlayton@...nel.org>,
        Khalid Aziz <khalid.aziz@...cle.com>,
        Lei Yang <Lei.Yang@...driver.com>,
        linux-fsdevel@...r.kernel.org, linux-kselftest@...r.kernel.org,
        linux-mm@...ck.org,
        Marc-André Lureau 
        <marcandre.lureau@...hat.com>,
        Mike Kravetz <mike.kravetz@...cle.com>, minchan@...nel.org,
        Shuah Khan <shuah@...nel.org>, valdis.kletnieks@...edu
Subject: Re: [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE_WRITE seal to
 memfd

On Wed, Nov 07, 2018 at 08:15:36PM -0800, Joel Fernandes (Google) wrote:
> Android uses ashmem for sharing memory regions. We are looking forward
> to migrating all usecases of ashmem to memfd so that we can possibly
> remove the ashmem driver in the future from staging while also
> benefiting from using memfd and contributing to it. Note staging drivers
> are also not ABI and generally can be removed at anytime.
> 
> One of the main usecases Android has is the ability to create a region
> and mmap it as writeable, then add protection against making any
> "future" writes while keeping the existing already mmap'ed
> writeable-region active.  This allows us to implement a usecase where
> receivers of the shared memory buffer can get a read-only view, while
> the sender continues to write to the buffer.
> See CursorWindow documentation in Android for more details:
> https://developer.android.com/reference/android/database/CursorWindow
> 
> This usecase cannot be implemented with the existing F_SEAL_WRITE seal.
> To support the usecase, this patch adds a new F_SEAL_FUTURE_WRITE seal
> which prevents any future mmap and write syscalls from succeeding while
> keeping the existing mmap active. The following program shows the seal
> working in action:
> 
[...] 
> The output of running this program is as follows:
> ret=3
> map 0 passed
> write passed
> map 1 prot-write passed as expected
> future-write seal now active
> write failed as expected due to future-write seal
> map 2 prot-write failed as expected due to seal
> : Permission denied
> map 3 prot-read passed as expected
> 
> Cc: jreck@...gle.com
> Cc: john.stultz@...aro.org
> Cc: tkjos@...gle.com
> Cc: gregkh@...uxfoundation.org
> Cc: hch@...radead.org
> Reviewed-by: John Stultz <john.stultz@...aro.org>
> Signed-off-by: Joel Fernandes (Google) <joel@...lfernandes.org>
> ---
> v1->v2: No change, just added selftests to the series. manpages are
> ready and I'll submit them once the patches are accepted.
> 
> v2->v3: Updated commit message to have more support code (John Stultz)
>  	Renamed seal from F_SEAL_FS_WRITE to F_SEAL_FUTURE_WRITE
> 						(Christoph Hellwig)
> 	Allow for this seal only if grow/shrink seals are also
> 	either previous set, or are requested along with this seal.
> 						(Christoph Hellwig)
> 	Added locking to synchronize access to file->f_mode.
> 						(Christoph Hellwig)


Christoph, do the patches look Ok to you now? If so, then could you give an
Acked-by or Reviewed-by tag?

Thanks a lot,

 - Joel


>  include/uapi/linux/fcntl.h |  1 +
>  mm/memfd.c                 | 22 +++++++++++++++++++++-
>  2 files changed, 22 insertions(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h
> index 6448cdd9a350..a2f8658f1c55 100644
> --- a/include/uapi/linux/fcntl.h
> +++ b/include/uapi/linux/fcntl.h
> @@ -41,6 +41,7 @@
>  #define F_SEAL_SHRINK	0x0002	/* prevent file from shrinking */
>  #define F_SEAL_GROW	0x0004	/* prevent file from growing */
>  #define F_SEAL_WRITE	0x0008	/* prevent writes */
> +#define F_SEAL_FUTURE_WRITE	0x0010  /* prevent future writes while mapped */
>  /* (1U << 31) is reserved for signed error codes */
>  
>  /*
> diff --git a/mm/memfd.c b/mm/memfd.c
> index 2bb5e257080e..5ba9804e9515 100644
> --- a/mm/memfd.c
> +++ b/mm/memfd.c
> @@ -150,7 +150,8 @@ static unsigned int *memfd_file_seals_ptr(struct file *file)
>  #define F_ALL_SEALS (F_SEAL_SEAL | \
>  		     F_SEAL_SHRINK | \
>  		     F_SEAL_GROW | \
> -		     F_SEAL_WRITE)
> +		     F_SEAL_WRITE | \
> +		     F_SEAL_FUTURE_WRITE)
>  
>  static int memfd_add_seals(struct file *file, unsigned int seals)
>  {
> @@ -219,6 +220,25 @@ static int memfd_add_seals(struct file *file, unsigned int seals)
>  		}
>  	}
>  
> +	if ((seals & F_SEAL_FUTURE_WRITE) &&
> +	    !(*file_seals & F_SEAL_FUTURE_WRITE)) {
> +		/*
> +		 * The FUTURE_WRITE seal also prevents growing and shrinking
> +		 * so we need them to be already set, or requested now.
> +		 */
> +		int test_seals = (seals | *file_seals) &
> +				 (F_SEAL_GROW | F_SEAL_SHRINK);
> +
> +		if (test_seals != (F_SEAL_GROW | F_SEAL_SHRINK)) {
> +			error = -EINVAL;
> +			goto unlock;
> +		}
> +
> +		spin_lock(&file->f_lock);
> +		file->f_mode &= ~(FMODE_WRITE | FMODE_PWRITE);
> +		spin_unlock(&file->f_lock);
> +	}
> +
>  	*file_seals |= seals;
>  	error = 0;
>  
> -- 
> 2.19.1.930.g4563a0d9d0-goog