linux-kernel - Re: [RFC PATCH RESEND v2 1/2] mm/memfd: Add support for F_SEAL_FUTURE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABi2SkWWfknibhP6KV16gbGH+Pj4kJC9JGUVaoLHyAwdxoucug@mail.gmail.com>
Date: Wed, 8 Jan 2025 08:34:03 -0800
From: Jeff Xu <jeffxu@...omium.org>
To: Alice Ryhl <aliceryhl@...gle.com>
Cc: Isaac Manjarres <isaacmanjarres@...gle.com>, Jann Horn <jannh@...gle.com>, 
	Kees Cook <keescook@...omium.org>, lorenzo.stoakes@...cle.com, 
	Jeff Layton <jlayton@...nel.org>, Chuck Lever <chuck.lever@...cle.com>, 
	Alexander Aring <alex.aring@...il.com>, Andrew Morton <akpm@...ux-foundation.org>, 
	Shuah Khan <shuah@...nel.org>, surenb@...gle.com, kaleshsingh@...gle.com, 
	jstultz@...gle.com, jeffxu@...gle.com, kees@...nel.org, 
	kernel-team@...roid.com, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-mm@...ck.org, 
	linux-kselftest@...r.kernel.org
Subject: Re: [RFC PATCH RESEND v2 1/2] mm/memfd: Add support for
 F_SEAL_FUTURE_EXEC to memfd

On Wed, Jan 8, 2025 at 5:57 AM Alice Ryhl <aliceryhl@...gle.com> wrote:
>
> On Tue, Jan 7, 2025 at 6:21 AM Jeff Xu <jeffxu@...omium.org> wrote:
> > Do you know which code checks for VM_MAYEXEC flag in the mprotect code
> > path ?  it isn't obvious to me, i.e. when I grep the VM_MAYEXEC inside
> > mm path, it only shows one place in mprotect and that doesn't do the
> > work.
> >
> > ~/mm/mm$ grep VM_MAYEXEC *
> > mmap.c: mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
> > mmap.c: vm_flags &= ~VM_MAYEXEC;
> > mprotect.c: if (rier && (vma->vm_flags & VM_MAYEXEC))
> > nommu.c: vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
> > nommu.c: vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
>
> The check happens here:
>
> /* newflags >> 4 shift VM_MAY% in place of VM_% */
> if ((newflags & ~(newflags >> 4)) & VM_ACCESS_FLAGS) {
>     error = -EACCES;
>     break;
> }

Thanks for helping !
-Jeff

>
> Alice