Hi Pratyush,
On Mon, Jan 26, 2026 at 01:47:21PM +0100, Pratyush Yadav wrote:
> Hi Mike,
>
> On Sun, Jan 25 2026, Mike Rapoport wrote:
> > On Fri, Jan 23, 2026 at 10:58:51AM +0100, Pratyush Yadav wrote:
...
> >> - file = memfd_alloc_file("", 0);
> >> + /*
> >> + * The seals are preserved. Allow sealing here so they can be added
> >> + * later.
> >> + */
> >> + file = memfd_alloc_file("", MFD_ALLOW_SEALING);
> >
> > I think we should select flags passed to memfd_alloc_file() based on
> > ser->seals (and later based on ser->seals and ser->flags).
>
> Not sure what you mean.
>
> I think the only seal we can set via memfd_alloc_file() flags is
> MFD_NOEXEC_SEAL, which is really a F_SEAL_EXEC and plus a change of the
> inode's mode. And now that I think of it, that is a valid use case that
> we might as well support. But I think that should be done by preserving
> the mode of the inode directly, and then copying the seals back. The
> main reason for that is that the mode can be changed after the memfd is
> created too.
>
> Other than that, all other seals are set by fcntl (via
> memfd_add_seals()), so I don't see what else we can pass to
> memfd_alloc_file().
Hmm, "using ser->seals" was bad phrasing :)
Now we add support for creating memfd with MFD_ALLOW_SEALING and at some
point we'd want MFD_HUGETLB and huge page size.
So I think we should have a field in ser that will define what flags should
be used for creation of memfd and based on the value of that field pass the
flags to memfd_alloc_file().
For seals support this field can be hardwired to MFD_ALLOW_SEALING at preserve
time.
> >> if (IS_ERR(file)) {
> >> pr_err("failed to setup file: %pe\n", file);
> >> err = PTR_ERR(file);
> >> goto free_ser;
> >> }
> >>
> >> + err = memfd_add_seals(file, ser->seals);
> >
> > I'm not sure using MFD_ALLOW_SEALING is enough if there was F_SEAL_EXEC in
> > seals.
>
> Why not? memfd_add_seals() can handle F_SEAL_EXEC as far as I can tell.
I just noticed it behaved differently :)
Looks like F_SEAL_EXEC indeed can handle it.
> --
> Regards,
> Pratyush Yadav
--
Sincerely yours,
Mike.
