Re: [RFC PATCH v2 1/1] exec: seal system mappings

[Jeff Xu <jeffxu@chromium.org>]

On Thu, Oct 17, 2024 at 1:38 AM Oleg Nesterov <oleg@redhat.com> wrote:
>
> On 10/16, Jeff Xu wrote:
> >
> > On Wed, Oct 16, 2024 at 6:10 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> > >
> > > > +     exec.seal_system_mappings = [KNL]
> > > > +                     Format: { never | always }
> > > > +                     Seal system mappings: vdso, vvar, sigpage, uprobes,
> > > > +                     vsyscall.
> > > > +                     This overwrites KCONFIG CONFIG_SEAL_SYSTEM_MAPPINGS_*
> > > > +                     - 'never':  never seal system mappings.
> > >
> > > Not true, uprobes are sealed when 'never' is selected.
> > >
> > Thanks. I forgot to uprobes from the description in Kconfig and
> > kernel-parameters.txt, will update.
>
> Jeff, I am sorry for confusion.
>
> No need to make uprobes "special" and complicate the logic/documentation.
>
> I just meant that, unlike vdso, it is always safe/good to mseal the "[uprobes]"
> vma, regardless of config/boot options.
>
> Please do what you think is right, I am fine either way.
>
OK, in that case, V1 is a better approach, using the same config to
control all system mappings.
I will send V1 to revert that.

Thanks for clarifying.
-Jeff

> Oleg.
>