From: <jeffxu@google.com>
To: skhan@linuxfoundation.org
Cc: akpm@linux-foundation.org, dmitry.torokhov@gmail.com,
dverkamp@chromium.org, hughd@google.com, jeffxu@google.com,
jorgelo@chromium.org, keescook@chromium.org,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-mm@kvack.org, mnissler@chromium.org, jannh@google.com,
Jeff Xu <jeffxu@chromium.org>
Subject: [PATCH v2 2/5] mm/memfd: add MFD_NOEXEC flag to memfd_create
Date: Fri, 5 Aug 2022 22:21:23 +0000 [thread overview]
Message-ID: <20220805222126.142525-3-jeffxu@google.com> (raw)
In-Reply-To: <20220805222126.142525-1-jeffxu@google.com>
From: Daniel Verkamp <dverkamp@chromium.org>
The new MFD_NOEXEC flag allows the creation of a permanently
non-executable memfd. This is accomplished by creating it with a
different set of file mode bits (0666) than the default (0777) and
applying the F_SEAL_EXEC seal at creation time, so there is no window
between memfd creation and seal application.
Unfortunately, the default for memfd must remain executable, since
changing this would be an API break, and some programs depend on being
able to exec code from a memfd directly. However, this new flag will
allow programs to create non-executable memfds, and a distribution may
choose to enforce use of this flag in memfd_create calls via other
security mechanisms.
Co-developed-by: Jeff Xu <jeffxu@chromium.org>
Signed-off-by: Jeff Xu <jeffxu@chromium.org>
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
---
include/uapi/linux/memfd.h | 1 +
mm/memfd.c | 10 +++++++++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/memfd.h b/include/uapi/linux/memfd.h
index 7a8a26751c23..140e125c9f65 100644
--- a/include/uapi/linux/memfd.h
+++ b/include/uapi/linux/memfd.h
@@ -8,6 +8,7 @@
#define MFD_CLOEXEC 0x0001U
#define MFD_ALLOW_SEALING 0x0002U
#define MFD_HUGETLB 0x0004U
+#define MFD_NOEXEC 0x0008U
/*
* Huge page size encoding when MFD_HUGETLB is specified, and a huge page
diff --git a/mm/memfd.c b/mm/memfd.c
index 4ebeab94aa74..b841514eb0fd 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -263,7 +263,7 @@ long memfd_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
#define MFD_NAME_PREFIX_LEN (sizeof(MFD_NAME_PREFIX) - 1)
#define MFD_NAME_MAX_LEN (NAME_MAX - MFD_NAME_PREFIX_LEN)
-#define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_HUGETLB)
+#define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_HUGETLB | MFD_NOEXEC)
SYSCALL_DEFINE2(memfd_create,
const char __user *, uname,
@@ -333,6 +333,14 @@ SYSCALL_DEFINE2(memfd_create,
*file_seals &= ~F_SEAL_SEAL;
}
+ if (flags & MFD_NOEXEC) {
+ struct inode *inode = file_inode(file);
+
+ inode->i_mode &= ~0111;
+ file_seals = memfd_file_seals_ptr(file);
+ *file_seals |= F_SEAL_EXEC;
+ }
+
fd_install(fd, file);
kfree(name);
return fd;
--
2.37.1.559.g78731f0fdb-goog
next prev parent reply other threads:[~2022-08-05 22:22 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-05 22:21 [PATCH v2 0/5] mm/memfd: MFD_NOEXEC for memfd_create jeffxu
2022-08-05 22:21 ` [PATCH v2 1/5] mm/memfd: add F_SEAL_EXEC jeffxu
2022-08-05 22:21 ` jeffxu [this message]
2022-08-05 22:21 ` [PATCH v2 3/5] selftests/memfd: add tests for F_SEAL_EXEC jeffxu
2022-08-05 22:21 ` [PATCH v2 4/5] selftests/memfd: add tests for MFD_NOEXEC jeffxu
2022-08-05 22:21 ` [PATCH v2 5/5] sysctl: add support for mfd_noexec jeffxu
2022-08-13 18:35 ` kernel test robot
2022-08-13 19:06 ` kernel test robot
2022-08-08 17:46 ` [PATCH v2 0/5] mm/memfd: MFD_NOEXEC for memfd_create Kees Cook
2022-11-01 23:14 ` Jeff Xu
2022-11-02 2:45 ` Kees Cook
2022-11-02 17:18 ` Jeff Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220805222126.142525-3-jeffxu@google.com \
--to=jeffxu@google.com \
--cc=akpm@linux-foundation.org \
--cc=dmitry.torokhov@gmail.com \
--cc=dverkamp@chromium.org \
--cc=hughd@google.com \
--cc=jannh@google.com \
--cc=jeffxu@chromium.org \
--cc=jorgelo@chromium.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mnissler@chromium.org \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).