[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Z3LHUWH8YyKGgNX7@krava>
Date: Mon, 30 Dec 2024 17:16:17 +0100
From: Jiri Olsa <olsajiri@...il.com>
To: Daniel Xu <dxu@...uu.xyz>, Andrei Enache <andreien@...ton.me>
Cc: ast@...nel.org, andrii@...nel.org, daniel@...earbox.net,
eddyz87@...il.com, martin.lau@...ux.dev, song@...nel.org,
yonghong.song@...ux.dev, john.fastabend@...il.com,
kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com,
bpf@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next] libbpf: Set MFD_NOEXEC_SEAL when creating memfd
On Sun, Dec 29, 2024 at 02:44:33PM -0700, Daniel Xu wrote:
> Since 105ff5339f49 ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC"), the
> kernel has started printing a warning if neither MFD_NOEXEC_SEAL nor
> MFD_EXEC is set in memfd_create().
>
> To avoid this warning (and also be more secure), set MFD_NOEXEC_SEAL by
> default. But since libbpf can be running on potentially very old
> kernels, leave a fallback for kernels without MFD_NOEXEC_SEAL support.
>
> Signed-off-by: Daniel Xu <dxu@...uu.xyz>
there's similar change posted by Andrei already:
https://lore.kernel.org/bpf/eTid-pMaxx4d_gMkyFN6fgVGub01RRJYIl1SzTmRG7RtRlPUJOMrVfe2I1W8s0OBHBFy3UN2WGm_e6mak0nGcrZ4ZdxAYRUSDDcUSVMvNA4=@proton.me/T/#u
jirka
> ---
> tools/lib/bpf/libbpf.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 66173ddb5a2d..46492cc0927d 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -1731,12 +1731,24 @@ static int sys_memfd_create(const char *name, unsigned flags)
> #ifndef MFD_CLOEXEC
> #define MFD_CLOEXEC 0x0001U
> #endif
> +#ifndef MFD_NOEXEC_SEAL
> +#define MFD_NOEXEC_SEAL 0x0008U
> +#endif
>
> static int create_placeholder_fd(void)
> {
> + unsigned int flags = MFD_CLOEXEC | MFD_NOEXEC_SEAL;
> + const char *name = "libbpf-placeholder-fd";
> int fd;
>
> - fd = ensure_good_fd(sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC));
> + fd = ensure_good_fd(sys_memfd_create(name, flags));
> + if (fd >= 0)
> + return fd;
> + else if (errno != EINVAL)
> + return -errno;
> +
> + /* Possibly running on kernel without MFD_NOEXEC_SEAL */
> + fd = ensure_good_fd(sys_memfd_create(name, flags & ~MFD_NOEXEC_SEAL));
> if (fd < 0)
> return -errno;
> return fd;
> --
> 2.47.1
>
Powered by blists - more mailing lists