MSEAL_SYSTEM_MAPPINGS is in security/Kconfig, but it's an mm feature, it's implemented in mm, and changes to it need to go past mm.
Let's move it to mm/Kconfig, next to the other VMA features. No functional change. Suggested-by: Lorenzo Stoakes <[email protected]> Signed-off-by: Chris Down <[email protected]> --- mm/Kconfig | 21 +++++++++++++++++++++ security/Kconfig | 21 --------------------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/mm/Kconfig b/mm/Kconfig index afff1b25b543..40172787dfa7 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1355,6 +1355,27 @@ config ANON_VMA_NAME area from being merged with adjacent virtual memory areas due to the difference in their name. +config MSEAL_SYSTEM_MAPPINGS + bool "mseal system mappings" + depends on 64BIT + depends on ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS + depends on !CHECKPOINT_RESTORE + help + Apply mseal on system mappings. + The system mappings includes vdso, vvar, vvar_vclock, + vectors (arm compat-mode), sigpage (arm compat-mode), uprobes. + + A 64-bit kernel is required for the memory sealing feature. + No specific hardware features from the CPU are needed. + + WARNING: This feature breaks programs which rely on relocating + or unmapping system mappings. Known broken software at the time + of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr. Therefore + this config can't be enabled universally. + + For complete descriptions of memory sealing, please see + Documentation/userspace-api/mseal.rst + config HAVE_ARCH_USERFAULTFD_WP bool help diff --git a/security/Kconfig b/security/Kconfig index f7bf6cdc6229..1679e8d009c3 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -49,27 +49,6 @@ config PROC_MEM_NO_FORCE endchoice -config MSEAL_SYSTEM_MAPPINGS - bool "mseal system mappings" - depends on 64BIT - depends on ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS - depends on !CHECKPOINT_RESTORE - help - Apply mseal on system mappings. - The system mappings includes vdso, vvar, vvar_vclock, - vectors (arm compat-mode), sigpage (arm compat-mode), uprobes. - - A 64-bit kernel is required for the memory sealing feature. - No specific hardware features from the CPU are needed. - - WARNING: This feature breaks programs which rely on relocating - or unmapping system mappings. Known broken software at the time - of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr. Therefore - this config can't be enabled universally. - - For complete descriptions of memory sealing, please see - Documentation/userspace-api/mseal.rst - config SECURITY bool "Enable different security models" depends on SYSFS -- 2.54.0
