On Wed, May 22, 2024 at 7:25 PM Barnabás Pőcze <[email protected]> wrote: > > Hi > > > 2024. május 23., csütörtök 1:23 keltezéssel, Andrew Morton > <[email protected]> írta: > > > On Wed, 15 May 2024 23:11:12 -0700 Jeff Xu <[email protected]> wrote: > > > > > On Mon, May 13, 2024 at 12:15 PM Barnabás Pőcze <[email protected]> > > > wrote: > > > > > > > > `MFD_NOEXEC_SEAL` should remove the executable bits and set > > > > `F_SEAL_EXEC` to prevent further modifications to the executable > > > > bits as per the comment in the uapi header file: > > > > > > > > not executable and sealed to prevent changing to executable > > > > > > > > However, currently, it also unsets `F_SEAL_SEAL`, essentially > > > > acting as a superset of `MFD_ALLOW_SEALING`. Nothing implies > > > > that it should be so, and indeed up until the second version > > > > of the of the patchset[0] that introduced `MFD_EXEC` and > > > > `MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not removed, however it > > > > was changed in the third revision of the patchset[1] without > > > > a clear explanation. > > > > > > > > This behaviour is suprising for application developers, > > > > there is no documentation that would reveal that `MFD_NOEXEC_SEAL` > > > > has the additional effect of `MFD_ALLOW_SEALING`. > > > > > > > Ya, I agree that there should be documentation, such as a man page. I will > > > work on that. > > > > > > > So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested. > > > > This is technically an ABI break, but it seems very unlikely that an > > > > application would depend on this behaviour (unless by accident). > > > > > > > > [0]: > > > > https://lore.kernel.org/lkml/[email protected]/ > > > > [1]: > > > > https://lore.kernel.org/lkml/[email protected]/ > > > > > > ... > > > > > > Reviewed-by: Jeff Xu <[email protected]> > > > > It's a change to a userspace API, yes? Please let's have a detailed > > description of why this is OK. Why it won't affect any existing users. > > Yes, it is a uAPI change. To trigger user visible change, a program has to > > - create a memfd > - with MFD_NOEXEC_SEAL, > - without MFD_ALLOW_SEALING; > - try to add seals / check the seals. > > This change in essence reverts the kernel's behaviour to that of Linux <6.3, > where > only `MFD_ALLOW_SEALING` enabled sealing. If a program works correctly on > those > kernels, it will likely work correctly after this change. > I agree with this.
The current memfd_test.c doesn't have good coverage sealable vs not_seable, most tests are created with MFD_ALLOW_SEALING I think the test_sysctl_set_sysctl0/1/2 need to add cases for no-sealable memfd. because the change will also change the behavior of the sysctl. Do you want to add them as part of the patch ? > I have looked through Debian Code Search and GitHub, searching for > `MFD_NOEXEC_SEAL`. > And I could find only a single breakage that this change would case: > dbus-broker > has its own memfd_create() wrapper that is aware of this implicit > `MFD_ALLOW_SEALING` > behaviour[0], and tries to work around it. This workaround will break. > Luckily, > however, as far as I could tell this only affects the test suite of > dbus-broker, > not its normal operations, so I believe it should be fine. I have prepared a > PR > with a fix[1]. > Thanks for the investigation. > > > > > Also, please let's give consideration to a -stable backport so that all > > kernel versions will eventually behave in the same manner. > > > > > > I think that is a good idea, should I resend this with the `Cc: stable@...` > tag or > what should I do? > > > Regards, > Barnabás Pőcze > > > [0]: > https://github.com/bus1/dbus-broker/blob/9eb0b7e5826fc76cad7b025bc46f267d4a8784cb/src/util/misc.c#L114 > [1]: https://github.com/bus1/dbus-broker/pull/366
