From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00EE6C47DB3 for ; Fri, 2 Feb 2024 04:22:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6A5116B0075; Thu, 1 Feb 2024 23:22:44 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 655836B0078; Thu, 1 Feb 2024 23:22:44 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4F6BA6B007B; Thu, 1 Feb 2024 23:22:44 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 3C55C6B0075 for ; Thu, 1 Feb 2024 23:22:44 -0500 (EST) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id B0FEB1406E7 for ; Fri, 2 Feb 2024 04:22:43 +0000 (UTC) X-FDA: 81745567806.12.F75444D Received: from mail-oa1-f46.google.com (mail-oa1-f46.google.com [209.85.160.46]) by imf28.hostedemail.com (Postfix) with ESMTP id ECF8BC0012 for ; Fri, 2 Feb 2024 04:22:41 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=cflr7vFA; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf28.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.160.46 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1706847762; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=GY7gduymNb2zU8foO6bHqxA7R4wx0/8BTl8lBqhvbv0=; b=c5GHvcAOzvE6MnW0VHC+Zel12kCjQF3wMBrXgkbAKWg6fzvFbxfSy+dlABbyd+UdM1Jtef Rn9Umviai1q9CJu/r2pAZsdI6UlW/8YsFHlbekI0j608Q4TQhFHQ/MajXVd+j2sknexLdm /et930+FEYj7IP4HUjDe/uFhNv/LtCQ= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=cflr7vFA; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf28.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.160.46 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1706847762; a=rsa-sha256; cv=none; b=5KkNGG89H9i2Nfmd2sGKmdh74N2crnMcOw8Wh888TbmJpW+C6McnAF7xQFsYC9c7scDU7Z rUrQgHQ3+bC3ANQoW+xogxze3nWqDuXWx3WX2vkBYQm//Hc4ycHguN1z0otynANr38cPjK scACGY52CasZD+KN84Czr7jpJ1NL1po= Received: by mail-oa1-f46.google.com with SMTP id 586e51a60fabf-2046b2cd2d3so1216449fac.0 for ; Thu, 01 Feb 2024 20:22:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1706847761; x=1707452561; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=GY7gduymNb2zU8foO6bHqxA7R4wx0/8BTl8lBqhvbv0=; b=cflr7vFAoVa3CZTNT6XiggVcuMJY9ET4f4m3Tu9RFXBgFly6l2876v5UKWI8TS47/Q Lgb/pCqYqXz6BgFrEtBtEhsxdBTEL3zu9LlKuwqQlmyHHmx31hj4jCHxu2qIWtwsKrNn X5svMxCqIVfJKHeI07ArCoQqUqvLiRzMdJCU0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706847761; x=1707452561; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=GY7gduymNb2zU8foO6bHqxA7R4wx0/8BTl8lBqhvbv0=; b=U/ScfNEkfgZP1wE85RVCyPDnoTR4w0/hQJ2DiJtGE08kbYy/he89Q1CN/YPwVf4ERK nXKqXTQ3AR22tsVDiNnb1B9Y4q2uMwdnmU8FLJ0p2lD4lyjq0gy+epgc4SXQDuWV1T/y l35SMXYFtItyenGnVJLtjmsJCkv2bTAjasNET3Z6lLWUunRbBI0Hp0uHYBhfBnwXrD6q HcAsNEuWNrwBx/5BtShqWUNI+LyEp7TcwggNe9XcLE9UbiQeFQUd6l1N+i4//rjvkDsX d2aaCQb1pMDXbYrmM0JVT4OILgZ6eSyV1eEXJlvDvByBa0R/08xhnRvc85s1HVIqKk1p Gshg== X-Gm-Message-State: AOJu0YxKSsC0yV6EviIYH0LN/QsYSfsFzQ9035l+FRNzCZnM+F7mDGLb lxTYTXOGyK5GNFQ2uxYYyaGT+bjAqNAzntl4Qpw/lx2bIZmjkjgmhnIw7iOHsrEKeIfZHbZrP9q lTW1f+nDQRdjWwOxa+09INLQXIh7zJOrR34n0 X-Google-Smtp-Source: AGHT+IEkUEa7oB3LxBaxRdRQm5KW+tylq4x0W184us0zAIA6K3G/17ndemyjfLrzARBtr3pklpjp5BmCmP98g7ITzIA= X-Received: by 2002:a05:6870:7908:b0:214:2a08:897d with SMTP id hg8-20020a056870790800b002142a08897dmr8699235oab.46.1706847761083; Thu, 01 Feb 2024 20:22:41 -0800 (PST) MIME-Version: 1.0 References: <20240131175027.3287009-1-jeffxu@chromium.org> <20240131175027.3287009-3-jeffxu@chromium.org> <20240201231151.GA41472@sol.localdomain> <96087.1706846050@cvs.openbsd.org> <72434.1706847038@cvs.openbsd.org> In-Reply-To: <72434.1706847038@cvs.openbsd.org> From: Jeff Xu Date: Thu, 1 Feb 2024 20:22:29 -0800 Message-ID: Subject: Re: [PATCH v8 2/4] mseal: add mseal syscall To: Theo de Raadt Cc: Eric Biggers , akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, sroettger@google.com, willy@infradead.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, usama.anjum@collabora.com, rdunlap@infradead.org, jeffxu@google.com, jorgelo@chromium.org, groeck@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, pedro.falcato@gmail.com, dave.hansen@intel.com, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: ECF8BC0012 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: yf1rirtpf6qagapuj6awhz9yi1m1c43d X-HE-Tag: 1706847761-306736 X-HE-Meta: U2FsdGVkX1/nrPI1wLNNHzrrOPzcdSkUqL3tKPyn6SJoeSKzcDu2kcvQy2Rm6BYQitf7FgwuFvN/tMq0yq/n2v+eMne+Wnrv32IFh82SdhQk3mXO6zOa9fnVO6j8aXNO7BK/uFud3wJX4YPKtqiHn9x/ndfMmA0P9mtphxm/2fE5BLJ4n9CHe4tOHrENsiqpiwqSs+OhEC464RdoTxz6J3jZo0pL2K7UezZhhkWOoFH+jFHQqMuqTrU/c8ftIL6I1ufE6Rk7D+gGeVBqwuowBC4QjRcwMAueN29StpZ61PwYAwTXDp+H8GGWIgAXq4uOYfM4KOPUIjqRHtDKyZRW6mKJR1otUqEfr+Jp+BayAC2W+EROaQOFrXQDcuI91idzPhOZqJe9Lkv+h3Plk/LkaduXvYBVjK4E1652I+PCUutc7Q6B9szeeWbjvcKnj0nRRBdcBIdsmmsbvdNQX+rcrRqb3L3NP+sMRhEGXbvEyEJJDWetUs7Cn9a/e5LjjY76suhJeMM5LuuHItqWLy7xDFtQkuoMoRKVUFdgzuVP0xBi47fypCHR9JKFdnC73WcVT7n7xcfhq88P2QXzLKYmOsHklprPknx8sKr57vY2b31RUcxAS0/FpD14AiAxGMWFhAfeGP0tzYrxBBypdFHA6k80Pw6t3638EBKn2LcTocstzrrFfp3Eid029CDYAfhkNi2ZVKWXVMl4IGRaLD0jt8J6yTJnwnMHn+BCByr/ro10TtF23xlVBRRMzRXc9XrQ3mUUsr9dCIrHEiW3EedFW7dTWDTTfIrGj2NVlYSDzhWN6xaRnqZern3WZqxf1hSiXAEX1C6lHmwNItNv8Am32liWQY0ueGnpz1gJUS2RDWb7MQFTuLZkoNrq2YeLlLmFBpjD3+I3O2HaQ8BirHVGxVTbQQmFwJ1ZqF247JCcFxnW7nf45aMItd2BUfkChBzWeQ6nqcmYWehn1UMCCsN dzU9M7KG zWNRIqYQNZPKowm97SZzae9knpD/9WqecK6ZtTKsfxcwmHFmWwRIXajWW1hQ2lfSLEwPZ1P2z0JE45UAKXhG2tpqVO5rFxsEltY8BeqIWwZJY65qMsols1U6sFPgz8GziPnXhCSOX+iaOsUQo4V6yqFq0MtqIcs8p4DgVd7nUkRuaK88qOjRb9e6a4GTJ1UiwlvignExJIVZJ1jfD746nJieIdeNv7PeRGffnN6OU4HQFX1TWMrTbwv1tpawkr9cxX2rdSsGjPjjniM3dQZsc0WLLtO+d9OZf2HfuPvcg/nXkRlGZ9RY52irh9/joV1DYh5YcfWpDc6yKzaYo3fBCGzQb3olepw6jica+15Z5uFCO7V9oAzS6Y2pOmoA3YF8j16mbLNGs14RiqdHEngN5BGNxzMfrZ5UZ2kcp5mOWj8DvIcigJDstHbaUuq8a9lZiZLQK37VYbESrdrf+9TFYZpA1q0DExEYs8yML X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Feb 1, 2024 at 8:10=E2=80=AFPM Theo de Raadt = wrote: > > Jeff Xu wrote: > > > On Thu, Feb 1, 2024 at 7:54=E2=80=AFPM Theo de Raadt wrote: > > > > > > Jeff Xu wrote: > > > > > > > On Thu, Feb 1, 2024 at 3:11=E2=80=AFPM Eric Biggers wrote: > > > > > > > > > > On Wed, Jan 31, 2024 at 05:50:24PM +0000, jeffxu@chromium.org wro= te: > > > > > > [PATCH v8 2/4] mseal: add mseal syscall > > > > > [...] > > > > > > +/* > > > > > > + * The PROT_SEAL defines memory sealing in the prot argument o= f mmap(). > > > > > > + */ > > > > > > +#define PROT_SEAL 0x04000000 /* _BITUL(26) */ > > > > > > + > > > > > > /* 0x01 - 0x03 are defined in linux/mman.h */ > > > > > > #define MAP_TYPE 0x0f /* Mask for type of mappi= ng */ > > > > > > #define MAP_FIXED 0x10 /* Interpret addr exactly= */ > > > > > > @@ -33,6 +38,9 @@ > > > > > > #define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, me= mory could be > > > > > > * uninitialized */ > > > > > > > > > > > > +/* map is sealable */ > > > > > > +#define MAP_SEALABLE 0x8000000 /* _BITUL(27) */ > > > > > > > > > > IMO this patch is misleading, as it claims to just be adding a ne= w syscall, but > > > > > it actually adds three new UAPIs, only one of which is the new sy= scall. The > > > > > other two new UAPIs are new flags to the mmap syscall. > > > > > > > > > The description does include all three. I could update the patch ti= tle. > > > > > > > > > Based on recent discussions, it seems the usefulness of the new m= map flags has > > > > > not yet been established. Note also that there are only a limite= d number of > > > > > mmap flags remaining, so we should be careful about allocating th= em. > > > > > > > > > > Therefore, why not start by just adding the mseal syscall, withou= t the new mmap > > > > > flags alongside it? > > > > > > > > > > I'll also note that the existing PROT_* flags seem to be conventi= onally used for > > > > > the CPU page protections, as opposed to kernel-specific propertie= s of the VMA > > > > > object. As such, PROT_SEAL feels a bit out of place anyway. If = it's added at > > > > > all it perhaps should be a MAP_* flag, not PROT_*. I'm not sure = this aspect has > > > > > been properly discussed yet, seeing as the patchset is presented = as just adding > > > > > sys_mseal(). Some reviewers may not have noticed or considered t= he new flags. > > > > > > > > > MAP_ flags is more used for type of mapping, such as MAP_FIXED_NORE= PLACE. > > > > > > > > The PROT_SEAL might make more sense because sealing the protection = bit > > > > is the main functionality of the sealing at this moment. > > > > > > Jeff, please show a piece of software that needs to do PROT_SEAL as > > > mprotect() or mmap() argument. > > > > > I didn't propose mprotect(). > > > > for mmap() here is a potential use case: > > > > fs/binfmt_elf.c > > if (current->personality & MMAP_PAGE_ZERO) { > > /* Why this, you ask??? Well SVr4 maps page 0 as read-= only, > > and some applications "depend" upon this behavior. > > Since we do not have the power to recompile these, w= e > > emulate the SVr4 behavior. Sigh. */ > > > > error =3D vm_mmap(NULL, 0, PAGE_SIZE, > > PROT_READ | PROT_EXEC, <-- add PROT_S= EAL > > MAP_FIXED | MAP_PRIVATE, 0); > > } > > > > I don't see the benefit of RWX page 0, which might make a null > > pointers error to become executable for some code. > > > > And this is a lot faster than doing the operation as a second step? > > > But anyways, that's kernel code. It is not userland exposed API used > by programs. > > The question is the damage you create by adding API exposed to > userland (since this is Linux: forever). > > I should be the first person thrilled to see Linux make API/ABI mistakes > they have to support forever, but I can't be that person. > Point taken. I can remove PROT_SEAL. > >