From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC5CFC4167B for ; Wed, 14 Dec 2022 18:53:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 509FF8E0005; Wed, 14 Dec 2022 13:53:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 493EB8E0002; Wed, 14 Dec 2022 13:53:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 334308E0005; Wed, 14 Dec 2022 13:53:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 209948E0002 for ; Wed, 14 Dec 2022 13:53:23 -0500 (EST) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id CAA0F80E02 for ; Wed, 14 Dec 2022 18:53:22 +0000 (UTC) X-FDA: 80241809844.04.4E7879A Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by imf15.hostedemail.com (Postfix) with ESMTP id 2BBFBA0002 for ; Wed, 14 Dec 2022 18:53:20 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="DPayc+N/"; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf15.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1671044001; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=x9cSnaEhv8Xds1q1FVg4f4vmMN7yeuDq7gGdjSEFO6Y=; b=ytOvH2dpst5DxTya7odMbMb8IHGLgEbZbNfu1KRiqn7m5rCt5ARmDTeAOhjGfnvKlDJBfg cxDSmv/bm1zn+gf9PDKhbmnI2oy+vU7zJWdHC0yoqJfwZGo9rPVrDhXqYdId/0sQk9csRN SNrd7hjsmBSOugHq8jPcMoMjO8ih8f0= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="DPayc+N/"; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf15.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1671044001; a=rsa-sha256; cv=none; b=Zo4pTlQDE6Vx7Z/Veb21+1ZVOcZ4ZhvN5QW6pAubHeMt5pt+7QX2DCHiKLRitwDSx+7WQD A9wOEiGqrr/iqdisRn8QNdc+woru58B53TfaIWcoWQDl0msuOXtVoEh5QooOCzAx2dh5yy qm44BUxFLOVb11cDS0hTgzUDyu8fzhE= Received: by mail-pg1-f179.google.com with SMTP id r18so2584756pgr.12 for ; Wed, 14 Dec 2022 10:53:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=x9cSnaEhv8Xds1q1FVg4f4vmMN7yeuDq7gGdjSEFO6Y=; b=DPayc+N/6klm+cJJopr92jIZbcDzMcXAgHRTd0IdOF/l4lVMTfSv9uiMdbB9vgE7Rn KbN0Mf0w8PPxXiyyFo2dcpPrOOs/0smlRbhGYtuM7nD8UC7C5xF9GWVy9VrRO8OTEMv3 4YqQIBNhShJXwz7nnmrlPdy5R/1q13TzzW7ZY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=x9cSnaEhv8Xds1q1FVg4f4vmMN7yeuDq7gGdjSEFO6Y=; b=1BDf3RZzGAy2iI7nHY8+NozUzsogZoNJTOjKeD+hnnsEoAMw/o5ZCcL5sdFe/XFsqa MK1DVduUDTuJYoaNyzTnwj1NGw00kQaiVsRC0XB85pBE4381c6ZF/6DFg22UEszITKII CKvd/zZ200hvHev0I96RqRFOi610ONIThWHay+RZ6hG3exqjCi7WdLgo0s10wYfX/j0w jv0i1J/tNyVGgKRU5VeMEnFrIwlHb8ccXa/yw4dqqqj1wGtyqHgMjHoTB/d8hKlBzo1c fwV5QAfduT17jU4Gf7Jy6nz1vB0MP+Vfjc/uYrPS6PYOCjhD3jlfVSA/VpfjGsiXulJR hZ4Q== X-Gm-Message-State: ANoB5pnerbKA/P54oi9WM+Oy6+bfeBnBcOjlhDDclDoXNixl5vRPXPQS eAhvysMsBBFxBRl5O+Q4fXHdeg== X-Google-Smtp-Source: AA0mqf4dRo8AoZc0bYEWLv4+RgOdgi6k/5UHIiZnszRrU+HEBbp0UQLJCi++JGunvqp7GrihTtWLRw== X-Received: by 2002:a05:6a00:791:b0:577:f836:6bcb with SMTP id g17-20020a056a00079100b00577f8366bcbmr23822313pfu.29.1671044000031; Wed, 14 Dec 2022 10:53:20 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c129-20020a624e87000000b0056b9ec7e2desm198403pfb.125.2022.12.14.10.53.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Dec 2022 10:53:19 -0800 (PST) Date: Wed, 14 Dec 2022 10:53:19 -0800 From: Kees Cook To: jeffxu@chromium.org Cc: skhan@linuxfoundation.org, akpm@linux-foundation.org, dmitry.torokhov@gmail.com, dverkamp@chromium.org, hughd@google.com, jeffxu@google.com, jorgelo@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, jannh@google.com, linux-hardening@vger.kernel.org, linux-security-module@vger.kernel.org, kernel test robot Subject: Re: [PATCH v7 3/6] mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC Message-ID: <202212141053.DD016F79B@keescook> References: <20221209160453.3246150-1-jeffxu@google.com> <20221209160453.3246150-4-jeffxu@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221209160453.3246150-4-jeffxu@google.com> X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 2BBFBA0002 X-Stat-Signature: 9qyjf96yk5wenr318se1sa354irrgjue X-HE-Tag: 1671044000-902286 X-HE-Meta: U2FsdGVkX1+ZFMdn+IpiUofhDidEiY0aXYKGmkxHB/qeN7hj4U1Gq6JJwjpo82jvMGDe/WN+W5ajVFzPgMHjokOdUdwldnHVpdvV6aonlehsROFjMCvpvDjX+F6pDvBZEl8x2cEn0tBFraLNyxYTaRIGcYGcGLguPoNapiEZeWL/SXRAXHQFWInbWWs0weZpyVF9OyBiBwm2c/IJ0GazK+RM0d/abnXPBwoWDbXwovfl+SV/ZccbQJlD0NJ9LbumicaFZuZVtRNspAxiM0xj2TNuxbd9ycgx6EaSJ9w+gmr8GIdpRJpiOWi5DtkROSKNMPheo/rxYikcSSE2MlqyCq9HEbKCWZsPL6I8e2nL/QjuGwDLLtXTjjdtofz2lSLAjlnkwyeRkPGqg0CZ/ecRsGiZ88BC0Pl+ke6gvH93hNJ0Fu+Awp/0AOnShpVlu/zYOzG3LBfm9/3yyf02g3VQ3uEoDOKCvf3mPUEHbkcviWQgb/cOtL9CJgtDecJnPAL1mOgoQ0FAv0J/Mew+WDFR5skofyl4/Q36t6CpSJQJBOn2tTA7yXiLFCkgB9xAp/v1m1ijDUWP1twHx5vJwxOvebTyHYF8bpklNIYDNtay8PdeZuXKeA6xCBNYnhe5ES1XKAeBSB9ya/3UGsRBhZ3ioyK8BcDQEjCb/gj8VcY+LtaKiBn5j8rJFChyeUCUY6VLd3PyFW8QEpbK4po9YqmAf2xa08OXiL/y5qPtLYOG8Zpg72Jzulr7+sOjnsvPvKUcqeONuMuJUH380hhEMDepsIcA2IFqCYFE5nPVQeClYeEUQEDiQ3qr/hPqvZwnQI1R5II9zykrmbVdbmnsTYSqOG3LO9G7vPSfcvpozckgkzYE/l3CiOHssTmQKfaErplnIUVD3qWRBRKpAA5S6f5MatOrK7MzzxG6w5lqjI6ItjWpeW3Tl7kriWbNcOOUoG1mF8fqe9t9ZV9Q0MEc5KW QGLiBa/M wgLGiEnZi2ECzik+1jRj2DlrYSv2bxZCIYaDSoybQv7HsR9t7tQB+scOGt491WC/JAZ5WijjeiGXg/GmpS3gwZYbMOqYFX1gx0RhPScHswsbgz62/8i7a3R2QF/7/L5xQT53z7rHnrNE3M2aOVH4SgHg0uY4BX9BemfXR6stJUHKGRCCmibqTefzQik+z5EHOu6U6QKNiZ4lNq1I7EnzOWdshvg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000006, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Dec 09, 2022 at 04:04:50PM +0000, jeffxu@chromium.org wrote: > From: Jeff Xu > > The new MFD_NOEXEC_SEAL and MFD_EXEC flags allows application to > set executable bit at creation time (memfd_create). > > When MFD_NOEXEC_SEAL is set, memfd is created without executable bit > (mode:0666), and sealed with F_SEAL_EXEC, so it can't be chmod to > be executable (mode: 0777) after creation. > > when MFD_EXEC flag is set, memfd is created with executable bit > (mode:0777), this is the same as the old behavior of memfd_create. > > The new pid namespaced sysctl vm.memfd_noexec has 3 values: > 0: memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts like > MFD_EXEC was set. > 1: memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts like > MFD_NOEXEC_SEAL was set. > 2: memfd_create() without MFD_NOEXEC_SEAL will be rejected. > > The sysctl allows finer control of memfd_create for old-software > that doesn't set the executable bit, for example, a container with > vm.memfd_noexec=1 means the old-software will create non-executable > memfd by default. Also, the value of memfd_noexec is passed to child > namespace at creation time. For example, if the init namespace has > vm.memfd_noexec=2, all its children namespaces will be created with 2. > > Signed-off-by: Jeff Xu Reviewed-by: Kees Cook -- Kees Cook