linux-kernel - Re: [PATCH v5 3/6] mm/memfd: add MFD_NOEXEC_SEAL and MFD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Dec 2022 09:48:55 -0800
From:   Jeff Xu <jeffxu@...gle.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     jeffxu@...omium.org, skhan@...uxfoundation.org,
        keescook@...omium.org, akpm@...ux-foundation.org,
        dmitry.torokhov@...il.com, dverkamp@...omium.org, hughd@...gle.com,
        jorgelo@...omium.org, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-mm@...ck.org,
        jannh@...gle.com, linux-hardening@...r.kernel.org,
        kernel test robot <lkp@...el.com>
Subject: Re: [PATCH v5 3/6] mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC

On Tue, Dec 6, 2022 at 8:35 AM Greg KH <gregkh@...uxfoundation.org> wrote:
>
> On Tue, Dec 06, 2022 at 08:26:30AM -0800, Jeff Xu wrote:
> > On Tue, Dec 6, 2022 at 8:04 AM Greg KH <gregkh@...uxfoundation.org> wrote:
> > >
> > > On Tue, Dec 06, 2022 at 03:23:55PM +0000, jeffxu@...omium.org wrote:
> > > > --- a/kernel/pid_namespace.c
> > > > +++ b/kernel/pid_namespace.c
> > > > @@ -110,6 +110,11 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns
> > > >       ns->ucounts = ucounts;
> > > >       ns->pid_allocated = PIDNS_ADDING;
> > > >
> > > > +#if defined(CONFIG_SYSCTL) && defined(CONFIG_MEMFD_CREATE)
> > > > +     ns->memfd_noexec_scope =
> > > > +             task_active_pid_ns(current)->memfd_noexec_scope;
> > > > +#endif
> > >
> > > .c files should never have #if in them.  Can't you put this in a .h file
> > > properly so that this does not get really messy over time?
> > >
> > >
> > Thanks for reviewing.
> > It seems to me that checking for CONFIG_XXX is  common in c code in
> > kernel/ path.
>
> Maybe, but please don't make it any worse if at all possible.  It's
> tough to maintain code like that.
>
> > Do you have a sample code pattern (link/function) that I can follow?
>
> Any of the zillions of #if statements in .h files :)
>
Thanks.
I will take the approach of having real/stub implementation in the h
file, and the c file  using it without a compile flag.
Please kindly let me know if this is not right.

Thanks
Jeff

> thanks,
>
> greg k-h