linux-kernel - Re: [PATCH v3 2/7] prctl: introduce PR_DEFAULT_MADV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez2y_PP7Uba8uq_Y+auKRUHPcJ19Nnn15GAaVS=M4DC73g@mail.gmail.com>
Date: Tue, 20 May 2025 01:01:38 +0200
From: Jann Horn <jannh@...gle.com>
To: Usama Arif <usamaarif642@...il.com>, lorenzo.stoakes@...cle.com
Cc: Andrew Morton <akpm@...ux-foundation.org>, david@...hat.com, linux-mm@...ck.org, 
	hannes@...xchg.org, shakeel.butt@...ux.dev, riel@...riel.com, ziy@...dia.com, 
	laoar.shao@...il.com, baolin.wang@...ux.alibaba.com, Liam.Howlett@...cle.com, 
	npache@...hat.com, ryan.roberts@....com, vbabka@...e.cz, 
	Arnd Bergmann <arnd@...db.de>, linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org, 
	kernel-team@...a.com
Subject: Re: [PATCH v3 2/7] prctl: introduce PR_DEFAULT_MADV_HUGEPAGE for the process

On Tue, May 20, 2025 at 12:33 AM Usama Arif <usamaarif642@...il.com> wrote:
> This is set via the new PR_SET_THP_POLICY prctl. It has 2 affects:
> - It sets VM_HUGEPAGE and clears VM_NOHUGEPAGE on the default VMA flags
>   (def_flags). This means that every new VMA will be considered for
>   hugepage.
> - Iterate through every VMA in the process and call hugepage_madvise
>   on it, with MADV_HUGEPAGE policy.
> The policy is inherited during fork+exec.

As I replied to Lorenzo's series
(https://lore.kernel.org/all/CAG48ez3-7EnBVEjpdoW7z5K0hX41nLQN5Wb65Vg-1p8DdXRnjg@mail.gmail.com/),
it would be nice if you could avoid introducing new flags that have
the combination of all the following properties:

1. persists across exec
2. not cleared on secureexec execution
3. settable without ns_capable(CAP_SYS_ADMIN)
4. settable without NO_NEW_PRIVS

Flags that have all of these properties need to be reviewed extra
carefully to see if there is any way they could impact the security of
setuid binaries, for example by changing mmap() behavior in a way that
makes addresses significantly more predictable.