From patchwork Thu Jan 2 23:32:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Isaac Manjarres X-Patchwork-Id: 13925058 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C987E77188 for ; Thu, 2 Jan 2025 23:33:02 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D2D5D6B007B; Thu, 2 Jan 2025 18:33:01 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CB6406B0082; Thu, 2 Jan 2025 18:33:01 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B57246B0083; Thu, 2 Jan 2025 18:33:01 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 9462E6B007B for ; Thu, 2 Jan 2025 18:33:01 -0500 (EST) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 39D121404CF for ; Thu, 2 Jan 2025 23:33:01 +0000 (UTC) X-FDA: 82964113092.12.7B497B8 Received: from mail-pj1-f73.google.com (mail-pj1-f73.google.com [209.85.216.73]) by imf28.hostedemail.com (Postfix) with ESMTP id E702AC000B for ; Thu, 2 Jan 2025 23:32:04 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=jdllhInH; spf=pass (imf28.hostedemail.com: domain of 3KiJ3Zw4KCI0z9rrt3r40r88v9x55x2v.t532z4BE-331Crt1.58x@flex--isaacmanjarres.bounces.google.com designates 209.85.216.73 as permitted sender) smtp.mailfrom=3KiJ3Zw4KCI0z9rrt3r40r88v9x55x2v.t532z4BE-331Crt1.58x@flex--isaacmanjarres.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1735860740; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=QDuU3J1IGGphn0zaLirngh/aUSWdaIEND3bK3n59yFo=; b=tWaclwuQ4BxkLbuxtaiEyyw+DthLxqnyqDU6opZGNhZht1WAXWtq05FQIHudyhtropN0T3 pXgoSH/x7ZfGrv1TjXjafWVakOc/I/rcfkQ/eX9wSzs0mwEEF5kDbtMAAi3jIKwmKflNRM +NwMHhw6aL6nMvj52WCL9VbLNL5bxTI= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=jdllhInH; spf=pass (imf28.hostedemail.com: domain of 3KiJ3Zw4KCI0z9rrt3r40r88v9x55x2v.t532z4BE-331Crt1.58x@flex--isaacmanjarres.bounces.google.com designates 209.85.216.73 as permitted sender) smtp.mailfrom=3KiJ3Zw4KCI0z9rrt3r40r88v9x55x2v.t532z4BE-331Crt1.58x@flex--isaacmanjarres.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1735860740; a=rsa-sha256; cv=none; b=Ti+LUpktSxhL+svblzaAg0+xNhvG3UZx2Pi9OFZNrhX45EMJO31pcAHCXPMxQH4hVxwluz BFQuB0WBMVffMHYFBTUVD4ks6qtaEAiAhehizMFZxTGtnF6NJiS+wEmAPPtf8tMxfwnjvG zo+TrABFmk9YeBzhRySa8jGFzwsJaFU= Received: by mail-pj1-f73.google.com with SMTP id 98e67ed59e1d1-2efa0eb9dacso16420163a91.1 for ; Thu, 02 Jan 2025 15:32:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1735860778; x=1736465578; darn=kvack.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=QDuU3J1IGGphn0zaLirngh/aUSWdaIEND3bK3n59yFo=; b=jdllhInHOFuyiQ/3u0Ync+jHaCwsP4BzSFrA6HpOaTNBb+NPZ4i+2+TlCj44bQ+bPP myyeAIKc3AW33CF+SY7P9UySuWjQFI04KHOjyq27VWep60kHjvEqaymVvJRU5zu1vN34 Mcro0lwuVPNb6PQaNAvZlsYUTHsv6oL6vikPr5aQDSs9Avnwnoq1XPFbuy3pTSXmoSQD hoRNdNtwnJPw/48NXufu3paX8+CiDCFBPSQqRDiXUPk5ZG1olWcA1U1GAiKMiSiMhUiZ W88Li+4qWRBESBjJnJHfmG5yiebo3BUuZgf5d6X++2j67+O0OZ+M7dZIQVvJgBn+in7M PVbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1735860778; x=1736465578; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=QDuU3J1IGGphn0zaLirngh/aUSWdaIEND3bK3n59yFo=; b=Zmlh9DCDS5wZBWX8roW32IcelsTpwkWlVEHLiNfUXb7RYrgiE3UNOlT/7qu0/FST4D RVbET+gTnuLxYOvT1f1Z0yQXMusA1hhGl3UuQeOYu+SpNI3WBxA15QbXANqZQD1OPdxB bP1iynNINhtbL4BfJeSlaFVh+4o9aoQDTtkFG2rjXsTkR32N94xUQ7OQLti7w0tuU6oo 1rp+2NWso6mzdRKU3+WI0hr6kpWPPuZXnXdpPTtz7cNP8C3pb1BOyF9XOzEZBGu+UwtC I9gH8HEoweD+Aukb9RpegGe96eq13NKPDYKWyLvK6P7zUGyvePKyTngA/79rR5pZTztJ ANzQ== X-Forwarded-Encrypted: i=1; AJvYcCVLKyt52jwE42u2V5i9Qv7ASBtg8M2FyD3HS+oOOsY5FqYcVELN7IMW5v8TQxd1BWOK3jgWcozqVg==@kvack.org X-Gm-Message-State: AOJu0YytJczCcON6Ie2a16OgB76MUdjuttYqW7sAm/f8UyVBeaARbHFw 0JvkSnuwfu+Fwzxvlx8NU1c5345Qe8fniiLjdsWVpvz92DimkBEhAq9uWilmC+373mWKLDXU98e pZ0M5MKOT7QxdAoKdvTRtrvDfPsvj4aiiMQ== X-Google-Smtp-Source: AGHT+IG7y+IwwDV/Tqo322/ozip7aZe+2uc1Qx4485ddX1VhXCnLu1xgDDARozVocD5+sVJXjpD1g9odrGjfFfvYjZV0OA== X-Received: from pfwy1.prod.google.com ([2002:a05:6a00:1c81:b0:727:3a40:52d7]) (user=isaacmanjarres job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:1144:b0:729:597:4f97 with SMTP id d2e1a72fcca58-72abde828c1mr74507334b3a.20.1735860778070; Thu, 02 Jan 2025 15:32:58 -0800 (PST) Date: Thu, 2 Jan 2025 15:32:49 -0800 Mime-Version: 1.0 X-Mailer: git-send-email 2.47.1.613.gc27f4b7a9f-goog Message-ID: <20250102233255.1180524-1-isaacmanjarres@google.com> Subject: [RFC PATCH RESEND v2 0/2] Add file seal to prevent future exec mappings From: "Isaac J. Manjarres" To: lorenzo.stoakes@oracle.com, Jeff Layton , Chuck Lever , Alexander Aring , Andrew Morton , Shuah Khan Cc: surenb@google.com, kaleshsingh@google.com, jstultz@google.com, aliceryhl@google.com, jeffxu@google.com, kees@kernel.org, "Isaac J. Manjarres" , kernel-team@android.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org X-Rspamd-Queue-Id: E702AC000B X-Rspamd-Server: rspam12 X-Stat-Signature: zoxhk49f3ca7cr6p4myddrt5agh5i8f7 X-Rspam-User: X-HE-Tag: 1735860724-174238 X-HE-Meta: U2FsdGVkX1+PD8m+ajUuASeR/3vdttyOgT5Ujq39nSb11P+ZVrzuwK130/AHazY8p/OMQpZ3kQQ/+posUgvp8eRWb9FBrh2oozwchILCf2XqSU4OCfd/18S4Lo7DtS7AxeA3B47/VhhvIgghmF1v41DD3nwUH1L/IDxRR761IfhEp4rRAxy504e13WXlZcicsm/R+R24S6AMbCGy+GO7Hmu6S7reToxzIET/6YJNQkiP/tHpoIcU065idxHK4KjUbHmGrC0GnFzuJILcDLRVaZBcJTG+Ku9aFtkDI0hSgWVe+Gj40mO4wLfXYxAjy/BzQraYnghcQZKIoQIki+UCDoZvdDVmRW0J6LSHLgiev+uCcgVHI1YjW72U4AVKNhyHe1TKINNsjNLESFkQ++5/i0TUHiXi5FOCOH6UohAOIu6pMzBtzUJjrS55CWh651M8S6RB4FCxEbwKF5LvBj3bSeQ6lDKK0kh+d6Kf4Bjvza4nVPYBk0FhnrjWWpJlFopKmxmrjm5GSXmR7yYSTuyFIKlzQF0J/JCSArnBeuu8AkU+nYVPG48CiFFQ/tY8G6UGMsDiD+13MKBSWdhL+tb8kKa2MVVcdFu9YxJ5IYxwRQ1V1oCZWVULubQdczRtl28+1WTsV8yvA/YeyN2IqMmg2NqJrLxquWrkSmFGd3AvF2UcWTiGw2JtVx9THzhGK2LM7AwUUSWYhF3GOZF/w1UhJ+vv6zEsVkqCM9OjXRSRPBvae/k/iGYgDYy0TDeuPZjirODo0q9m+jMCcP81VEsxN0WOVOltBOn01s4dFe85QI03K6AKX6GU3K3HT6AQVC79pMG0/TOu15B/LbnbEqaN9V7vtRLZFevPNluQOX5QifxVNHd2omTcIxXK1Qs3QUxfIyOs1El08ZVrw1kwTGl1pK564yP81gp7xRQF7BII6mbtt7iA509um/YmJrMjTxHpm7OG80PVrwTyY/m2qvf GqplmyqN GWLrM6knHhF4Aj85EBmE+BrjrC8D+I3/OyD5Pggoq0WvrRnGdZpI8tizteS/X0DxDwxlfeqH+6FEiVsKJahns3E3/b3Qim9vSNnUKHh/w8hszvXhDfjJU0QhPnZGMSHPsIoAzJDH7uHsdYxCwFrjKkTQ5mFMz3tgV9hpQt4Qo0LmfclOWMnFh2/eg9aDp7q31YGCGjM7mMTb7VtibFPxKuqPkdDsWULpScH6eOMI1GSzlaTgxrw9dqfBaFrut+ebrWD77uqG4CkwllDSOvXjCAU0QHFRwKBk/03atRYyKYzgANRRNrdh+LUv+4s84oI7kP9o5AjcGpBWiym32nNpisQy00RGuwkaBUl+0YdGmvTOey+6tWfJ2Vs6t6XAqr7yfAU5dXink+e32I4idMqtGVMScNi/yYGzNLkN0gpahKA/LytvRVWVIxy+kikFv2oY3ompZNMGLsa2XypmF16KLDzZgVcJctPEU9ibDIQyc2bT87bgLwKYzFZaYZboW6+fMw4xxMftBpxmmByzm7hVGt1uOr0JdSxbmId9npP1u378VW0or4xiEZbZ3kZXbW6L7/DSf8pJt4Lkau6hShz9B8j0WM5SOkXB6XCpPuEv4sJzN7rrQ946SFNpd5feycbYt1b5PhbK5BCWf149ALF/82AXQnu/swOPfUaoTKftaBMMHQgJqqcQwSFZzzjeCrHy7LCa7BVNxLI+6wX3k7iOJGAzXTUNxZSdHrhojiWvE0iDiXbXriGa8cxapSQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.001042, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: * Resending because I accidentally forgot to include Lorenzo in the "to" list. Android uses the ashmem driver [1] for creating shared memory regions between processes. The ashmem driver exposes an ioctl command for processes to restrict the permissions an ashmem buffer can be mapped with. Buffers are created with the ability to be mapped as readable, writable, and executable. Processes remove the ability to map some ashmem buffers as executable to ensure that those buffers cannot be used to inject malicious code for another process to run. Other buffers retain their ability to be mapped as executable, as these buffers can be used for just-in-time (JIT) compilation. So there is a need to be able to remove the ability to map a buffer as executable on a per-buffer basis. Android is currently trying to migrate towards replacing its ashmem driver usage with memfd. Part of the transition involved introducing a library that serves to abstract away how shared memory regions are allocated (i.e. ashmem vs memfd). This allows clients to use a single interface for restricting how a buffer can be mapped without having to worry about how it is handled for ashmem (through the ioctl command mentioned earlier) or memfd (through file seals). While memfd has support for preventing buffers from being mapped as writable beyond a certain point in time (thanks to F_SEAL_FUTURE_WRITE), it does not have a similar interface to prevent buffers from being mapped as executable beyond a certain point. However, that could be implemented as a file seal (F_SEAL_FUTURE_EXEC) which works similarly to F_SEAL_FUTURE_WRITE. F_SEAL_FUTURE_WRITE was chosen as a template for how this new seal should behave, instead of F_SEAL_WRITE, for the following reasons: 1. Having the new seal behave like F_SEAL_FUTURE_WRITE matches the behavior that was present with ashmem. This aids in seamlessly transitioning clients away from ashmem to memfd. 2. Making the new seal behave like F_SEAL_WRITE would mean that no mappings that could become executable in the future (i.e. via mprotect()) can exist when the seal is applied. However, there are known cases (e.g. CursorWindow [2]) where restrictions are applied on how a buffer can be mapped after a mapping has already been made. That mapping may have VM_MAYEXEC set, which would not allow the seal to be applied successfully. Therefore, the F_SEAL_FUTURE_EXEC seal was designed to have the same semantics as F_SEAL_FUTURE_WRITE. Note: this series depends on Lorenzo's work [3], [4], [5] from Andrew Morton's mm-unstable branch [6], which reworks memfd's file seal checks, allowing for newer file seals to be implemented in a cleaner fashion. Changes from v1 ==> v2: - Changed the return code to be -EPERM instead of -EACCES when attempting to map an exec sealed file with PROT_EXEC to align to mmap()'s man page. Thank you Kalesh Singh for spotting this! - Rebased on top of Lorenzo's work to cleanup memfd file seal checks in mmap() ([3], [4], and [5]). Thank you for this Lorenzo! - Changed to deny PROT_EXEC mappings only if the mapping is shared, instead of for both shared and private mappings, after discussing this with Lorenzo. Opens: - Lorenzo brought up that this patch may negatively impact the usage of MFD_NOEXEC_SCOPE_NOEXEC_ENFORCED [7]. However, it is not clear to me why that is the case. At the moment, my intent is for the executable permissions of the file to be disjoint from the ability to create executable mappings. Links: [1] https://cs.android.com/android/kernel/superproject/+/common-android-mainline:common/drivers/staging/android/ashmem.c [2] https://developer.android.com/reference/android/database/CursorWindow [3] https://lore.kernel.org/all/cover.1732804776.git.lorenzo.stoakes@oracle.com/ [4] https://lkml.kernel.org/r/20241206212846.210835-1-lorenzo.stoakes@oracle.com [5] https://lkml.kernel.org/r/7dee6c5d-480b-4c24-b98e-6fa47dbd8a23@lucifer.local [6] https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/tree/?h=mm-unstable [7] https://lore.kernel.org/all/3a53b154-1e46-45fb-a559-65afa7a8a788@lucifer.local/ Links to previous versions: v1: https://lore.kernel.org/all/20241206010930.3871336-1-isaacmanjarres@google.com/ Isaac J. Manjarres (2): mm/memfd: Add support for F_SEAL_FUTURE_EXEC to memfd selftests/memfd: Add tests for F_SEAL_FUTURE_EXEC include/uapi/linux/fcntl.h | 1 + mm/memfd.c | 39 ++++++++++- tools/testing/selftests/memfd/memfd_test.c | 79 ++++++++++++++++++++++ 3 files changed, 118 insertions(+), 1 deletion(-)