Received-SPF: pass (google.com: domain of linux-kernel+bounces-37663-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: "Theo de Raadt" <deraadt@openbsd.org>
To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
    Jeff Xu <jeffxu@chromium.org>, akpm@linux-foundation.org,
    keescook@chromium.org, jannh@google.com, sroettger@google.com,
    willy@infradead.org, gregkh@linuxfoundation.org,
    torvalds@linux-foundation.org, usama.anjum@collabora.com,
    rdunlap@infradead.org, jeffxu@google.com, jorgelo@chromium.org,
    groeck@chromium.org, linux-kernel@vger.kernel.org,
    linux-kselftest@vger.kernel.org, linux-mm@kvack.org,
    pedro.falcato@gmail.com, dave.hansen@intel.com,
    linux-hardening@vger.kernel.org
Mail-Followup-To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
                  Jeff Xu <jeffxu@chromium.org>,
                  akpm@linux-foundation.org, keescook@chromium.org,
                  jannh@google.com, sroettger@google.com,
                  willy@infradead.org, gregkh@linuxfoundation.org,
                  torvalds@linux-foundation.org,
                  usama.anjum@collabora.com, rdunlap@infradead.org,
                  jeffxu@google.com, jorgelo@chromium.org,
                  groeck@chromium.org, linux-kernel@vger.kernel.org,
                  linux-kselftest@vger.kernel.org, linux-mm@kvack.org,
                  pedro.falcato@gmail.com, dave.hansen@intel.com,
                  linux-hardening@vger.kernel.org
Subject: Re: [PATCH v7 2/4] mseal: add mseal syscall
In-reply-to: <98656.1706128621@cvs.openbsd.org>
References: <20240122152905.2220849-1-jeffxu@chromium.org> <20240122152905.2220849-3-jeffxu@chromium.org> <20240123181457.idckaydk7dt7q2qy@revolver> <CABi2SkX=wKnHmooxXzBnJxxmtfSjvfgYabN1Wh1LxFYjtFoFaQ@mail.gmail.com> <20240124200628.ti327diy7arb7byb@revolver> <98656.1706128621@cvs.openbsd.org>
Comments: In-reply-to "Theo de Raadt" <deraadt@openbsd.org>
   message dated "Wed, 24 Jan 2024 13:37:01 -0700."
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <38861.1706129497.1@cvs.openbsd.org>
Date: Wed, 24 Jan 2024 13:51:37 -0700
Message-ID: <82138.1706129497@cvs.openbsd.org>

Theo de Raadt <deraadt@openbsd.org> wrote:

> This discussion about the malloc heap is ridiculous.  Obviously it is
> programmer error to lock the permissions on memory you will free for
> reuse.  But you can't fix this problem with malloc(), without breaking
> other extremely common circumstances where the allocation of memory
> and PERMANENT-USE-WITHOUT-RELEASE of such memory are seperated over a
> memory boundary, unless you start telling all open source library authors

  ^^^^^^^^^^^^^^^ library boundary, sorry

> to always use MAP_SEALABLE in their mmap() calls.

Example:

1. libcrypto (or some other library) has some ways to allocate memory and
   provide it to an application.
2. Even if this is using malloc(), heap allocations over a pagesize are
   page-aligned, so even then following assumptions are sound.
3. I have an application which uses that memory, but will never release the memory
   until program termination
4. The library interface is public and used by many programs, so the library
   author has a choice of using MAP_SEALABLE or not using MAP_SEALABLE

Due to your choice, my application cannot make lock the memory permissions
unless that library author chooses MAP_SEALABLE

If they choose to use MAP_SEALABLE, all programs get this memory you consider
less safe.

Exactly what is being gained here?