Received-SPF: pass (google.com: domain of linux-kernel+bounces-178012-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Mon, 13 May 2024 19:15:47 +0000
To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, akpm@linux-foundation.org, dmitry.torokhov@gmail.com, dverkamp@chromium.org, hughd@google.com, jeffxu@google.com, jorgelo@chromium.org, skhan@linuxfoundation.org, keescook@chromium.org
From: =?utf-8?Q?Barnab=C3=A1s_P=C5=91cze?= <pobrn@protonmail.com>
Subject: [PATCH v1] memfd: `MFD_NOEXEC_SEAL` should not imply `MFD_ALLOW_SEALING`
Message-ID: <20240513191544.94754-1-pobrn@protonmail.com>
Feedback-ID: 20568564:user:proton
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

`MFD_NOEXEC_SEAL` should remove the executable bits and set
`F_SEAL_EXEC` to prevent further modifications to the executable
bits as per the comment in the uapi header file:

  not executable and sealed to prevent changing to executable

However, currently, it also unsets `F_SEAL_SEAL`, essentially
acting as a superset of `MFD_ALLOW_SEALING`. Nothing implies
that it should be so, and indeed up until the second version
of the of the patchset[0] that introduced `MFD_EXEC` and
`MFD_NOEXEC_SEAL`, `F_SEAL_SEAL` was not removed, however it
was changed in the third revision of the patchset[1] without
a clear explanation.

This behaviour is suprising for application developers,
there is no documentation that would reveal that `MFD_NOEXEC_SEAL`
has the additional effect of `MFD_ALLOW_SEALING`.

So do not remove `F_SEAL_SEAL` when `MFD_NOEXEC_SEAL` is requested.
This is technically an ABI break, but it seems very unlikely that an
application would depend on this behaviour (unless by accident).

[0]: https://lore.kernel.org/lkml/20220805222126.142525-3-jeffxu@google.com=
/
[1]: https://lore.kernel.org/lkml/20221202013404.163143-3-jeffxu@google.com=
/

Fixes: 105ff5339f498a ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC")
Signed-off-by: Barnab=C3=A1s P=C5=91cze <pobrn@protonmail.com>
---

Or did I miss the explanation as to why MFD_NOEXEC_SEAL should
imply MFD_ALLOW_SEALING? If so, please direct me to it and
sorry for the noise.

---
 mm/memfd.c                                 | 9 ++++-----
 tools/testing/selftests/memfd/memfd_test.c | 2 +-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/mm/memfd.c b/mm/memfd.c
index 7d8d3ab3fa37..8b7f6afee21d 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -356,12 +356,11 @@ SYSCALL_DEFINE2(memfd_create,
=20
 =09=09inode->i_mode &=3D ~0111;
 =09=09file_seals =3D memfd_file_seals_ptr(file);
-=09=09if (file_seals) {
-=09=09=09*file_seals &=3D ~F_SEAL_SEAL;
+=09=09if (file_seals)
 =09=09=09*file_seals |=3D F_SEAL_EXEC;
-=09=09}
-=09} else if (flags & MFD_ALLOW_SEALING) {
-=09=09/* MFD_EXEC and MFD_ALLOW_SEALING are set */
+=09}
+
+=09if (flags & MFD_ALLOW_SEALING) {
 =09=09file_seals =3D memfd_file_seals_ptr(file);
 =09=09if (file_seals)
 =09=09=09*file_seals &=3D ~F_SEAL_SEAL;
diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/sel=
ftests/memfd/memfd_test.c
index 18f585684e20..b6a7ad68c3c1 100644
--- a/tools/testing/selftests/memfd/memfd_test.c
+++ b/tools/testing/selftests/memfd/memfd_test.c
@@ -1151,7 +1151,7 @@ static void test_noexec_seal(void)
 =09=09=09    mfd_def_size,
 =09=09=09    MFD_CLOEXEC | MFD_NOEXEC_SEAL);
 =09mfd_assert_mode(fd, 0666);
-=09mfd_assert_has_seals(fd, F_SEAL_EXEC);
+=09mfd_assert_has_seals(fd, F_SEAL_SEAL | F_SEAL_EXEC);
 =09mfd_fail_chmod(fd, 0777);
 =09close(fd);
 }
--=20
2.45.0