linux-kernel - Re: [PATCH v1 1/1] /proc/pid/smaps: add mseal info for vma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 14 Jun 2024 20:42:28 +0200
From: Jann Horn <jannh@...gle.com>
To: jeffxu@...omium.org
Cc: akpm@...ux-foundation.org, sroettger@...gle.com, rdunlap@...radead.org, 
	david@...hat.com, adhemerval.zanella@...aro.org, linux-kernel@...r.kernel.org, 
	linux-mm@...ck.org, jorgelo@...omium.org, keescook@...omium.org
Subject: Re: [PATCH v1 1/1] /proc/pid/smaps: add mseal info for vma

Hi!

On Fri, Jun 14, 2024 at 8:24 PM <jeffxu@...omium.org> wrote:
> Add sp in /proc/pid/smaps to indicate vma is sealed
>
> Signed-off-by: Jeff Xu <jeffxu@...omium.org>
> ---
>  Documentation/filesystems/proc.rst | 1 +
>  fs/proc/task_mmu.c                 | 3 +++
>  include/linux/mm.h                 | 5 +++++
>  mm/internal.h                      | 5 -----
>  4 files changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst
> index 7c3a565ffbef..400217a1589c 100644
> --- a/Documentation/filesystems/proc.rst
> +++ b/Documentation/filesystems/proc.rst
> @@ -571,6 +571,7 @@ encoded manner. The codes are the following:
>      um    userfaultfd missing tracking
>      uw    userfaultfd wr-protect tracking
>      ss    shadow stack page
> +    sp    sealed page

Nit: Why "page"? The sealing is a property of the VMA, not of the
pages mapped into it. Maybe "sealed area" and an abbreviation like
"sl" would make sense?

> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 587d34879865..8600564898fa 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -314,6 +314,11 @@ extern unsigned int kobjsize(const void *objp);
>  #define VM_NOHUGEPAGE  0x40000000      /* MADV_NOHUGEPAGE marked this vma */
>  #define VM_MERGEABLE   0x80000000      /* KSM may merge identical pages */
>
> +#ifdef CONFIG_64BIT
> +/* VM is sealed, in vm_flags */
> +#define VM_SEALED      _BITUL(63)
> +#endif
> +
>  #ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS
>  #define VM_HIGH_ARCH_BIT_0     32      /* bit only usable on 64-bit architectures */
>  #define VM_HIGH_ARCH_BIT_1     33      /* bit only usable on 64-bit architectures */

Other 64-bit flags are defined further down; maybe it would make sense
to move this definition below the definition of VM_ALLOW_ANY_UNCACHED,
so that the definitions are sorted by the number of the bit?