On Wed, May 22, 2024 at 7:25 PM Barnabás Pőcze pobrn@protonmail.com wrote:
Hi
- május 23., csütörtök 1:23 keltezéssel, Andrew Morton akpm@linux-foundation.org írta:
On Wed, 15 May 2024 23:11:12 -0700 Jeff Xu jeffxu@google.com wrote:
On Mon, May 13, 2024 at 12:15 PM Barnabás Pőcze pobrn@protonmail.com wrote:
`MFD_NOEXEC_SEAL` should remove the executable bits and set `F_SEAL_EXEC` to prevent further modifications to the executable bits as per the comment in the uapi header file:
not executable and sealed to prevent changing to executable
However, currently, it also unsets `F_SEAL_SEAL`, essentially acting as a superset of `MFD_ALLOW_SEALING`. Nothing implies that it should be so, and indeed up until the second version of the of the patchset[0] that introduced `MFD_EXEC` and `MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not removed, however it was changed in the third revision of the patchset[1] without a clear explanation.
This behaviour is suprising for application developers, there is no documentation that would reveal that `MFD_NOEXEC_SEAL` has the additional effect of `MFD_ALLOW_SEALING`.
Ya, I agree that there should be documentation, such as a man page. I will work on that.
So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested. This is technically an ABI break, but it seems very unlikely that an application would depend on this behaviour (unless by accident).
...
Reviewed-by: Jeff Xu jeffxu@google.com
It's a change to a userspace API, yes? Please let's have a detailed description of why this is OK. Why it won't affect any existing users.
Yes, it is a uAPI change. To trigger user visible change, a program has to
- create a memfd
- with MFD_NOEXEC_SEAL,
- without MFD_ALLOW_SEALING;
- try to add seals / check the seals.
This change in essence reverts the kernel's behaviour to that of Linux <6.3, where only `MFD_ALLOW_SEALING` enabled sealing. If a program works correctly on those kernels, it will likely work correctly after this change.
I agree with this.
The current memfd_test.c doesn't have good coverage sealable vs not_seable, most tests are created with MFD_ALLOW_SEALING I think the test_sysctl_set_sysctl0/1/2 need to add cases for no-sealable memfd. because the change will also change the behavior of the sysctl. Do you want to add them as part of the patch ?
I have looked through Debian Code Search and GitHub, searching for `MFD_NOEXEC_SEAL`. And I could find only a single breakage that this change would case: dbus-broker has its own memfd_create() wrapper that is aware of this implicit `MFD_ALLOW_SEALING` behaviour[0], and tries to work around it. This workaround will break. Luckily, however, as far as I could tell this only affects the test suite of dbus-broker, not its normal operations, so I believe it should be fine. I have prepared a PR with a fix[1].
Thanks for the investigation.
Also, please let's give consideration to a -stable backport so that all kernel versions will eventually behave in the same manner.
I think that is a good idea, should I resend this with the `Cc: stable@...` tag or what should I do?
Regards, Barnabás Pőcze