Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp1353465imu; Fri, 9 Nov 2018 15:15:55 -0800 (PST) X-Google-Smtp-Source: AJdET5fi8aZ9MGd3qoorULrTEl11p4S/fzw0WgLIeXqXptEVOopKUrsMjMEYQe8I0P9R/fVZF/V/ X-Received: by 2002:a63:24c2:: with SMTP id k185mr8859659pgk.406.1541805355183; Fri, 09 Nov 2018 15:15:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541805355; cv=none; d=google.com; s=arc-20160816; b=naO0kOy0r5trXXLIo6r2pt2cyYroZ78wzv+N1L6OFVN1l8Qy6jwabVzj/vCopNS6Rs 3G5EBVLIOkuf1IICE/v/J79M20BtIEszzJYbn6BbL45sBsdtydZbmtUDl943sxepanx3 cxzOQpBH+Pd/PmEwFSGEE21xnjEifYcQrhwcGSNRri8aAqEaQm2P91HImbMjd6WbVjui RIvcttuYvTYAqiVW/xK6hm71FhGuekI2yp9br+5emYB+PGMeDW/TIQrbYtXSQIDbuwQC r9kpHK8pOJa843l8OfRDbixs4k28/WYUjqNuiKcncxmiQEHqjAa6DJhycyO9F3Bhy3nT kxxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:to:references:message-id :content-transfer-encoding:cc:date:in-reply-to:from:subject :mime-version:dkim-signature; bh=Ecdfi+s3UHADkB/c9MvtGgEFKZcs4GegnUCkw0TJ+hk=; b=0iJyBKo5IW5mHfWDVBZW77YOZhp9nUpLERRjJFFLZjFx4Y5lAGllyJE61EujdJWRLy vVACmP7pTmt6fAKy9/ftinJtZG6oTWeDcxHrpwwuNJI9P2N/hT/E8hKRPDeiaOTJDtzL 2s4BSvYQI9u9XRwzkNQZnXcFryHh20Aod2QMFYg6rYJIE1tEiNbm++AdghXw92k1XSoN 7gPYdBoByq6Gcqvij8mPEUpLo17rSg1O5hBj4HYe4FL7E/iM6wfJSzx+Sb98GMxvVw0X 2rwfpmkGq8lM/ctedEAQrqIc3eONOcZ/Hf3oNKbaS8FhB6DFipFflSqKkN6rNbkut6cI g6cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amacapital-net.20150623.gappssmtp.com header.s=20150623 header.b=pE1MTJ1+; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 62-v6si8996050pla.217.2018.11.09.15.15.40; Fri, 09 Nov 2018 15:15:55 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@amacapital-net.20150623.gappssmtp.com header.s=20150623 header.b=pE1MTJ1+; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727979AbeKJI4u (ORCPT + 99 others); Sat, 10 Nov 2018 03:56:50 -0500 Received: from mail-pl1-f196.google.com ([209.85.214.196]:46441 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728283AbeKJI4t (ORCPT ); Sat, 10 Nov 2018 03:56:49 -0500 Received: by mail-pl1-f196.google.com with SMTP id c13-v6so1574589plz.13 for ; Fri, 09 Nov 2018 15:14:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amacapital-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Ecdfi+s3UHADkB/c9MvtGgEFKZcs4GegnUCkw0TJ+hk=; b=pE1MTJ1+tNrplxr+0LMaYhqlvih2j0Mdc8x/B/ilmRColjgNXleCTfJMBOQapitpE/ gaLOPibn3xY82ixgHtyAruFdb8jxdAofYZJAoMHAbKwJg/+Od3d2kUilB/o0PRADIK91 qG3WUScsNmp3M1CZsQZdTISto2jFijSuw5HM5P15FP8QebaVjW5j2ZSxq5Ip6LCDpQfX WaG+ouXQMx+fCRkt5RKgGRJc9j5E0DzS+dwMGVByZmnZKIbM3m1OxB/b9riaKigdkzX/ isPwUsPvyouOTfbwEdZYu6XgzCIyhadVjkdC9aTZL6FkFzpA9NnhFa2eAFhM1EB/xRH3 eWnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Ecdfi+s3UHADkB/c9MvtGgEFKZcs4GegnUCkw0TJ+hk=; b=A9siDU9KDHswN4kf5ZTw8fsDjraaIgHxHngUwJM7xolfMBLKHa8/48o/vjgkYQDxHO tzFhvYa/iRN/5/RntTu/HN4EFUmy3YPhLRbTEDyrBmZjOdm75qPA3VbVFB+uYlYQEcMS GtKkEYMb5MPUY8me/7kt8OAQWGZoSTtaNS1aqXdE/aVomhHMR4jGgvJeO9jQG14jvjcY a5oQgJ8DQAouLMt2MGQmPqze26JRGM8yUpvUswkQxldshBhJI1YlgPT4I+nkoTzZIWXM 3a3dnC/noSkK07xU+EcctgyKsQzypP4bHScEO+lzYPocTZBebJ7Y/eYE77QCb0CZa+ox BQcQ== X-Gm-Message-State: AGRZ1gIVsxucSrceEU9pcAZz2v1NeV/am/2Z0q6KZ95n3LX+SX2/EDdN hCVneO67Ka/hHF04Bwxa45cguA== X-Received: by 2002:a17:902:8b8c:: with SMTP id ay12-v6mr10370949plb.69.1541805244804; Fri, 09 Nov 2018 15:14:04 -0800 (PST) Received: from ?IPv6:2600:1010:b053:7a5b:70bc:5409:d54c:f5a1? ([2600:1010:b053:7a5b:70bc:5409:d54c:f5a1]) by smtp.gmail.com with ESMTPSA id k129sm11968615pgk.29.2018.11.09.15.14.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Nov 2018 15:14:04 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) Subject: Re: [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE_WRITE seal to memfd From: Andy Lutomirski X-Mailer: iPhone Mail (16A404) In-Reply-To: Date: Fri, 9 Nov 2018 15:14:02 -0800 Cc: Jann Horn , Joel Fernandes , kernel list , John Reck , John Stultz , Todd Kjos , Greg Kroah-Hartman , Christoph Hellwig , Al Viro , Andrew Morton , Bruce Fields , Jeff Layton , Khalid Aziz , Lei.Yang@windriver.com, linux-fsdevel@vger.kernel.org, linux-kselftest@vger.kernel.org, Linux-MM , marcandre.lureau@redhat.com, Mike Kravetz , Minchan Kim , Shuah Khan , valdis.kletnieks@vt.edu, Hugh Dickins , Linux API Content-Transfer-Encoding: quoted-printable Message-Id: References: <20181108041537.39694-1-joel@joelfernandes.org> To: Daniel Colascione Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > On Nov 9, 2018, at 2:42 PM, Daniel Colascione wrote: >=20 > On Fri, Nov 9, 2018 at 2:37 PM, Andy Lutomirski wrot= e: >>> Another, more general fix might be to prevent /proc/pid/fd/N opens >>> from "upgrading" access modes. But that'd be a bigger ABI break. >>=20 >> I think we should fix that, too. I consider it a bug fix, not an ABI bre= ak, personally. >=20 > Someone, somewhere is probably relying on it though, and that means > that we probably can't change it unless it's actually causing > problems. >=20 > spacebar heating I think it has caused problems in the past. It=E2=80=99s certainly extremely= surprising behavior. I=E2=80=99d say it should be fixed and, if needed, a s= ysctl to unfix it might be okay. >=20 >>>> That aside: I wonder whether a better API would be something that >>>> allows you to create a new readonly file descriptor, instead of >>>> fiddling with the writability of an existing fd. >>>=20 >>> That doesn't work, unfortunately. The ashmem API we're replacing with >>> memfd requires file descriptor continuity. I also looked into opening >>> a new FD and dup2(2)ing atop the old one, but this approach doesn't >>> work in the case that the old FD has already leaked to some other >>> context (e.g., another dup, SCM_RIGHTS). See >>> https://developer.android.com/ndk/reference/group/memory. We can't >>> break ASharedMemory_setProt. >>=20 >>=20 >> Hmm. If we fix the general reopen bug, a way to drop write access from a= n existing struct file would do what Android needs, right? I don=E2=80=99t k= now if there are general VFS issues with that. >=20 > I also proposed that. :-) Maybe it'd work best as a special case of > the perennial revoke(2) that people keep proposing. You'd be able to > selectively revoke all access or just write access. Sounds good to me, modulo possible races, but that shouldn=E2=80=99t be too h= ard to deal with.=