From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 694E3C021B2 for ; Tue, 25 Feb 2025 22:37:09 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DF59E280002; Tue, 25 Feb 2025 17:37:08 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id D7E70280001; Tue, 25 Feb 2025 17:37:08 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BF76C280002; Tue, 25 Feb 2025 17:37:08 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 9F0E1280001 for ; Tue, 25 Feb 2025 17:37:08 -0500 (EST) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 46B9116040D for ; Tue, 25 Feb 2025 22:37:08 +0000 (UTC) X-FDA: 83159928936.02.CF80262 Received: from mail-ot1-f46.google.com (mail-ot1-f46.google.com [209.85.210.46]) by imf29.hostedemail.com (Postfix) with ESMTP id 32461120010 for ; Tue, 25 Feb 2025 22:37:05 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=R6PsNoHG; spf=pass (imf29.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.46 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1740523026; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=he1zzs20/BQZyBVCAwd7XVf1k94Dy4rhXpIs1H1s64Q=; b=JjGnE2v4+UaY8y/9v5Djqy5MTrMvaZxQ55mCgBU8tJPR7fpvyy7wUTPvMzUdSHJHQgChji /PznqzE1ZzVWqw8tgxdKSIJyFi2U6ioGCUKReiuY9JL5OWEQKZjVGc3a05wqV3x4H/PlIa oCT96TjF1frMoeOPpmXPq+ne8PA8baU= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=R6PsNoHG; spf=pass (imf29.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.46 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1740523026; a=rsa-sha256; cv=none; b=LVmhVkl30r2n1GcJg5IBTr0D9sbsNWlh0fAlgZiVzLUcdesTqLkPU48MOkMEWSoiD/GanO ZZzvFM2473d4TTpQQe1UAZ6CzZXELOD79VF4W000cOlRiMkUgwkwwr7MxA/YqBa2DQXbFR o26W/UlrVe19SLALwZWkv98m645PMDQ= Received: by mail-ot1-f46.google.com with SMTP id 46e09a7af769-7231e216a06so969059a34.2 for ; Tue, 25 Feb 2025 14:37:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1740523025; x=1741127825; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=he1zzs20/BQZyBVCAwd7XVf1k94Dy4rhXpIs1H1s64Q=; b=R6PsNoHGpFlhXiVEbvbE3GpgLFYb8yy0Z+v7NYnJZ443nwM5lJCgbZOTdZUfrLh1T4 ToIkexrysO5jzXObhfBmsnJJnSQ2GwyZy8InEchWvsJbXFCd4PUKQfpq8T4NrHU1rJFE anrdjFrx0Gb4ZcS/vMQ7hodDeYRa5xIEyIT7A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740523025; x=1741127825; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=he1zzs20/BQZyBVCAwd7XVf1k94Dy4rhXpIs1H1s64Q=; b=KFTvrPc3A/f+nDt2k9MIxH2OiVoa+6V1/+xpZUuxsVHbGV5XuP/EEMzHu38NpJjkyV D+e83ZAOs4k8007JoZsUHpf2DuUG+sdZJS8vM5TqnavleMXyQTGNjUsCQ2Dv0h85Tc8+ qj02V4m8lMRkAAv1NcI80Uokzy/peESvLtKlRnAFYprI1Frm1k9alpQqHLEkKfppv4v/ fz1ejGkdx2vWCqoc+EaZwaGgyjjW4cWIylSJwZexNeX9Z6EHUFonBuMyPm1fk+SY/Ynt AYlePh9DYxoJ01YM5yg0uigrYZc3OgnEaeuZJ51RTxgDcdIlZ+1UOncNQRVKbu9c1vQS 46zw== X-Forwarded-Encrypted: i=1; AJvYcCWqfBNw+R6V/mjnvMyQwi3vPlmE5m5i3vmR4c6+gUwTGNz6BqjbOThYRZ8CfUo/LsHAUHy3a+MCQA==@kvack.org X-Gm-Message-State: AOJu0YwcrcA7pMX5508xL/MaDcRU8K2L4JcmxU/yzBlWqbw2GEfmgsUe r+jhtCAKZGucQdGmSr3kNJBrYAuH8VtTMMWvdyC+ru73bvmGGk11ZCljNB16Xvxh85s012yOfSN U6yJzKYz0p1kxg+SZz1+0p+rHhZJAHkPdKRH8 X-Gm-Gg: ASbGnctLc4Qml5rQ89bDjJRAmK7xJJEbVrBpogB1CD17iel8rXdBXg8of8cG1uhK2OP pzHgOEclL0fM/FOeWRjRjAhRmhyHUz26jWgkEOu7HMQgKAmDgCFfZLotBkLawGaE7QM7JXkx5su yIjKYd0/94hLXQSXifSRZeiVwXmiO0wmZ6I8c= X-Google-Smtp-Source: AGHT+IFE2qDJ7AHvWU5W+D1us/Ww7fyyu2BX+ztGdxXVJZ4ljOzbiiha3CUiXpNqk8NwHYvFjmfBwARhpEbPpjVTcNw= X-Received: by 2002:a05:6830:439e:b0:727:43c3:2a6d with SMTP id 46e09a7af769-7274c195252mr4799190a34.2.1740523024831; Tue, 25 Feb 2025 14:37:04 -0800 (PST) MIME-Version: 1.0 References: <20250224174513.3600914-1-jeffxu@google.com> <20250224174513.3600914-8-jeffxu@google.com> <7e1bfbf2-3115-408d-a40c-ae51a7ffffe4@lucifer.local> In-Reply-To: From: Jeff Xu Date: Tue, 25 Feb 2025 14:36:52 -0800 X-Gm-Features: AQ5f1JrkU6JVMfs8G1GrfbCiG-C4QL3T9-vXo5FQIi-W0ggnJJciFOmJtuj5F0E Message-ID: Subject: Re: [PATCH v6 7/7] mseal, system mappings: update mseal.rst To: Lorenzo Stoakes Cc: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, torvalds@linux-foundation.org, vbabka@suse.cz, Liam.Howlett@oracle.com, adhemerval.zanella@linaro.org, oleg@redhat.com, avagin@gmail.com, benjamin@sipsolutions.net, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, linux-mm@kvack.org, jorgelo@chromium.org, sroettger@google.com, hch@lst.de, ojeda@kernel.org, thomas.weissschuh@linutronix.de, adobriyan@gmail.com, johannes@sipsolutions.net, pedro.falcato@gmail.com, hca@linux.ibm.com, willy@infradead.org, anna-maria@linutronix.de, mark.rutland@arm.com, linus.walleij@linaro.org, Jason@zx2c4.com, deller@gmx.de, rdunlap@infradead.org, davem@davemloft.net, peterx@redhat.com, f.fainelli@gmail.com, gerg@kernel.org, dave.hansen@linux.intel.com, mingo@kernel.org, ardb@kernel.org, mhocko@suse.com, 42.hyeyoo@gmail.com, peterz@infradead.org, ardb@google.com, enh@google.com, rientjes@google.com, groeck@chromium.org, mpe@ellerman.id.au, aleksandr.mikhalitsyn@canonical.com, mike.rapoport@gmail.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 32461120010 X-Stat-Signature: x7gb9jqn8un3saqzcxh9heabn4odje39 X-HE-Tag: 1740523025-652661 X-HE-Meta: U2FsdGVkX19lt/6Nv+pFtjVFWoGGoug6r6fmqz11W5NxBdSSWxHVeqphEq6oV+8Cr5J2X4Y6+pVnS1wnOyixrLqk+I+ED8CnNYyQhekgB20Ilsl7a3sSnLtMqBp1efiNG5e+o1JU+t3Jf29cm8DCI25wSod202dwavE8ejEJr4FQTFkrIIJnOD5yt4TiMVfjv3h5+6rrdo8ae0Dq56AUKhGJ0LWiHEtv4dSDJbFhg6YJHTOqeGVcoRKUSyjB3Q9qKc+Ia5+KdMdjplrCQilalQ8j7IJmH/WE+zPuacsLU4NUJEIOQ/pcNwIhDEMsRPmnJ8v14N96eqf+kgRIRZYLeqTITQ446CVxC3QvCfZsmxUn2FK8qlnZJshAyMt1ujtIPCLmedehiQawLZnaabknDIXkHU0+LvSBpj0a9EjljLaqb1tgiYbUQcwteso1ipOUUakqlG8aDfitFjdwpS7M0vIwKsZus6aIRTZDC9HMbvQ4PhU4DTyplUTLOXahYUhmzV4AHlN1p9RChg2HwTSFkP9gzlGfY2QyLP3n7CMraSfIu8MU9k7JoWkFmRIZqDvP3HeQyVbDxp08hZ7tWd+CZQYMrKIhAGcpBjMCNTuOSqNOPFxJmHEeIyzd0EU/eZeABlQ6TvYDn0hEDKYUQAyFiOTigCqTYHWlF/qjLcU5O4O27Pkx8bsqR8iLO1Ns5VqMpVijrw3mloSjuCmpHV9Lp+9k1f19JXrn4noHchEIAIbR6ovyLt4zQqXzVlUfu3716BTcPRQyHXOSahrY8KKOTMTXaq0fKIbIxhNcRteYvKopZUKJvw9y0lvvDoE1RZY7QoPAIAWE1KazksPgonY+5duq3nFsKJrcE1AkSOIHLJ3keAcfErHuLjGlai9OBby0jUKvqDtdxA4TQVkPIaYH6BgtY6vdbqXIH868KatRLs+6Gcdpqfac5f2i7w5+O4UwpNzEY9FtPutowx34wsz CYcp0kA+ orAg9Lo3nOe84/pxsE3zurpodT3SQ2hMGjXtXIzVOzX5h7Htr9j6FokjOKCn8+DrTSwHy5m5ZziJjFxuAdaBCIgqQ9ktTCDlbuO3KElynGaJy6HWPewi6Dg6qyx9ZavMN1DjU8tRDzzx3iezH9Bht7xWzMBEGYCfa5ojXguaiGiSu3WiAPXQOfYg2yF5dzQrH+1NXU45uGoOjdf5iPfbBQ/kNIbH71IvJlDJobii6/ywIfGcSUgIzgJIa6fowjIpLLdk8ASSGbjHbnCgxEfyLp1mMqK14LtjIVRihoq1cYv/1LXXcdxzNNY95oAIcIphS0nvn X-Bogosity: Ham, tests=bogofilter, spamicity=0.000009, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Feb 25, 2025 at 2:31=E2=80=AFPM Jeff Xu wrote= : > > On Mon, Feb 24, 2025 at 10:07=E2=80=AFPM Lorenzo Stoakes > wrote: > > > > On Mon, Feb 24, 2025 at 05:45:13PM +0000, jeffxu@chromium.org wrote: > > > From: Jeff Xu > > > > > > Update memory sealing documentation to include details about system > > > mappings. > > > > > > Signed-off-by: Jeff Xu > > > --- > > > Documentation/userspace-api/mseal.rst | 7 +++++++ > > > 1 file changed, 7 insertions(+) > > > > > > diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/us= erspace-api/mseal.rst > > > index 41102f74c5e2..10147281bf2d 100644 > > > --- a/Documentation/userspace-api/mseal.rst > > > +++ b/Documentation/userspace-api/mseal.rst > > > @@ -130,6 +130,13 @@ Use cases > > > > > > - Chrome browser: protect some security sensitive data structures. > > > > > > +- System mappings: > > > + If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_= MAPPINGS), > > > + the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso,= vvar, > > > + uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, r= r are > > > + known to relocate or unmap system mapping, therefore this config c= an't be > > > + enabled universally. > > > > Thanks for adding this. > > > > Similar comments to the Kconfig update - you are listing features that = do not > > exist yet, please just list what you're doing, specifically, and avoid = the vague > > 'etc.', we don't need to be vague. > > > OK, I will remove etc and list the known mappings here. > > > As per the Kconfig comment - you need to be a lot more clear, I think y= ou're > > duplicating the text from there to here, so again I suggest something l= ike: > > > > WARNING: This feature breaks programs which rely on relocating or > > unmapping system mappings. > > > > Known broken software at the time of writing includes > > CHECKPOINT_RESTORE, UML, gVisor and rr. > > > Sure. > > > You also seem to be writing very little here, it's a documentation page= , you can > > be as verbose as you like :) > > > > You really need to add some more detail here in general - you aren't ex= plaining > > why people would want to enable this, what you're mitigating, etc. from= that you > > explain _why_ it doesn't work for some things. > > The mseal.rst already includes below regarding the protection/mitigation. Memory sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system. For example, such an attacker primitive can break control-flow integrity guarantees since read-only memory that is supposed to be trusted can become writable or .text pages can get remapped. Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security critical data at runtime. I could copy some sections from cover-letter to here, specifically for special mappings. > > > > > > > You're also not mentioning architectural limitations here, for instance= that you > > can only do this on arches that don't require VDSO relocation and listi= ng > > known-good arches. > > Sure, I will mention the architecture that has this enabled (x86,arm,uml) -- I don't think there is an architecture limitation though. mseal is a software feature. The reason why other architectures don't have it is due to the fact that I don't have the HW for testing > > This is a documentation file, you can go wild :) the more information h= ere the > > better. > > > > WARNING > > =3D=3D=3D=3D=3D=3D=3D > > > > > + > > > When not to use mseal > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > Applications can apply sealing to any virtual memory region from use= rspace, > > > -- > > > 2.48.1.601.g30ceb7b040-goog > > >