On Thu, Jun 28, 2018 at 2:34 PM, Daniel Borkmann <dan...@iogearbox.net> wrote: > Kees suggested that if set_memory_*() can fail, we should annotate it with > __must_check, and all callers need to deal with it gracefully given those > set_memory_*() markings aren't "advisory", but they're expected to actually > do what they say. This might be an option worth to move forward in future > but would at the same time require that set_memory_*() calls from supporting > archs are guaranteed to be "atomic" in that they provide rollback if part > of the range fails, once that happened, the transition from RW -> RO could > be made more robust that way, while subsequent RO -> RW transition /must/ > continue guaranteeing to always succeed the undo part.
Does this mean we can have BPF filters that aren't read-only then? What's the situation where set_memory_ro() fails? (Can it be induced by the user?) -Kees -- Kees Cook Pixel Security
