From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793124583; b=Y+Hx7TdtejwQbWspyXijevK5fgySfXXQSedFKq86SZBi12vJIMkAUDGOSli+bAhyiQ7s D+XhNZ1sh7CEdvPiwsNAxmYEHf5LlAkBi1so62aDFcaTNxnvg2OdIQrqHoX1q/+3tx49Q ujAh9pcSQr5Vc3Y4CvfVpTO3uKkHa+hOceQ7hsTNkuux51J8+bh5alLPsF6HuNVmgFnPn DYwanRH8BMjlhBZMdJ+qy4vJP2ORwPSihzNF80yCUAHNH8Ra695kIzXcPMMuJsgpbnLO3 qS9qZXVh/HDLHPa4V2x0E1sChxf3LJjtXT9k2XX7Ni7ga8QlBcvbEzN8JGUAMWqAcuw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793124583; h=Received:DKIM-Signature:Date:To:From:Subject:Message-Id; bh=+BRH51+aE6jShfTIZ5E6tPeSREMMVnaZJO89iPmsKMA=; b=ee3VgydsYQXasI5jigJnTL2ICTbXYyjlBWAlbkplRPwkWl8XTSlC+Z5MM1Q4Zj7PGED/ mwXHcbrvL0GjKc3b9FTbcn1rEUillyj4Ir/vPTcGJ4sY/y4QTZD3jaNKov3xHN7B2a1Uj rwHMk2n/PmmdBFJ+gdL+pP7t0sIhVWaTj9OGmsAwvIJbfILDmUAq2j22PUJeMll7trgL4 AE14xC1ToyaA5KPYBdZb8WfHbsJCOlmHlZXJP1SxMF1Y+i8Hh9Vst8YNdNEkz9a5Pe5Ec RtMttwWTfu8GwTNHP+JgXlH4RkeSMgqUpZHtXst5BnEaJpw3a6IJq1ZDcGmgLdlOPBw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=vVuATR10; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED2AB606A31F for ; Tue, 27 Oct 2026 18:09:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=vVuATR10 Received: by smtp.kernel.org (Postfix) with ESMTPSA id C43681F01825; Tue, 27 Oct 2026 18:09:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1793124582; bh=+BRH51+aE6jShfTIZ5E6tPeSREMMVnaZJO89iPmsKMA=; h=Date:To:From:Subject; b=vVuATR10KTkiZ8nhqMNTX2s84uQfega/JdWU53lRhmGa6gh3u/JJjGweuiWXgj24j /wiQ3V9dmeXmQzFoV3nGLKs8myZZw2pJVuLKtJyJ4OgROCOtrhsdA3sMjJzffadhx2 FYUJ4fZ8mI3H48nuy1qmGlKBJovQ18t2pywTTcTQ= Date: Tue, 27 Oct 2026 11:09:42 -0700 To: mm-commits@vger.kernel.org,mason@kernel.org,akpm@linux-foundation.org From: Andrew Morton Subject: [to-be-updated] mm-shmem-honour-f_seal_exec-when-an-acl-is-set.patch removed from -mm tree Message-Id: <20261027180942.C43681F01825@smtp.kernel.org> X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list The quilt patch titled Subject: mm/shmem: honour F_SEAL_EXEC when an ACL is set has been removed from the -mm tree. Its filename was mm-shmem-honour-f_seal_exec-when-an-acl-is-set.patch This patch was dropped because an updated version will be issued ------------------------------------------------------ From: Chris Mason Subject: mm/shmem: honour F_SEAL_EXEC when an ACL is set Date: Mon, 26 Oct 2026 10:40:37 +0100 The owner of a memfd sealed with F_SEAL_EXEC can still change its execute bits by setting a POSIX access ACL. With CONFIG_TMPFS_POSIX_ACL, this lets an unprivileged owner make a non-executable memfd executable, bypassing vm.memfd_noexec=2. simple_set_acl() updates i_mode directly, bypassing the seal check in shmem_setattr(). Add shmem_set_acl() to check the resulting mode. Share the F_SEAL_EXEC check with shmem_setattr() using memfd_check_seals_mode() in include/linux/memfd.h. Fix generated by an LLM and sent by Chris Mason in private. [david@kernel.org: use common helper; simplify description] Link: https://lore.kernel.org/20261026-fixes_shmem-v1-4-703206d5fa0c@kernel.org Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC") Signed-off-by: Chris Mason Signed-off-by: David Hildenbrand (Arm) Acked-by: Pedro Falcato Acked-by: Kiryl Shutsemau (Meta) Acked-by: Zi Yan Tested-by: Gregory Price (Meta) Cc: Joshua Hahn Cc: Rakie Kim Cc: Ying Huang Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Michal Hocko Cc: Hugh Dickins Cc: Baolin Wang Cc: Lukas Czerner Cc: Carlos Maiolino Cc: Christian Brauner Cc: Jan Kara Cc: Daniel Verkamp Cc: Jeff Xu Cc: Muchun Song Cc: Oscar Salvador Cc: David Stevens Cc: Matthew Wilcox (Oracle) Cc: William Kucharski Cc: Chris Li Cc: Kairui Song Cc: Nhat Pham Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Josef Bacik Cc: Eva Kurchatova Cc: Kairui Song Cc: Cc: --- include/linux/memfd.h | 9 +++++++++ mm/shmem.c | 35 ++++++++++++++++++++++++++++++----- 2 files changed, 39 insertions(+), 5 deletions(-) diff --git a/include/linux/memfd.h b/include/linux/memfd.h index c159e40e3f34a..272479317cf10 100644 --- a/include/linux/memfd.h +++ b/include/linux/memfd.h @@ -2,10 +2,19 @@ #ifndef __LINUX_MEMFD_H #define __LINUX_MEMFD_H +#include #include #define MEMFD_ANON_NAME "[memfd]" +static inline int memfd_check_seals_mode(unsigned int seals, umode_t old_mode, + umode_t new_mode) +{ + if ((seals & F_SEAL_EXEC) && ((old_mode ^ new_mode) & 0111)) + return -EPERM; + return 0; +} + #ifdef CONFIG_MEMFD_CREATE extern long memfd_fcntl(struct file *file, unsigned int cmd, unsigned int arg); struct folio *memfd_alloc_folio(struct file *memfd, pgoff_t idx); diff --git a/mm/shmem.c b/mm/shmem.c index d97fc32e7c942..86b9d19f26c7e 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -77,6 +77,7 @@ static struct vfsmount *shm_mnt __ro_after_init; #include #include #include +#include #include #include #include @@ -1549,10 +1550,11 @@ static int shmem_setattr(const struct mnt_idmap *idmap, if (error) return error; - if ((info->seals & F_SEAL_EXEC) && (attr->ia_valid & ATTR_MODE)) { - if ((inode->i_mode ^ attr->ia_mode) & 0111) { - return -EPERM; - } + if (attr->ia_valid & ATTR_MODE) { + error = memfd_check_seals_mode(info->seals, inode->i_mode, + attr->ia_mode); + if (error) + return error; } if (S_ISREG(inode->i_mode) && (attr->ia_valid & ATTR_SIZE)) { @@ -5400,12 +5402,35 @@ static const struct file_operations shmem_file_operations = { #endif }; +#ifdef CONFIG_TMPFS_POSIX_ACL +static int shmem_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry, + struct posix_acl *acl, int type) +{ + struct inode *inode = d_inode(dentry); + umode_t mode = inode->i_mode; + int error; + + if (type == ACL_TYPE_ACCESS) { + error = posix_acl_equiv_mode(acl, &mode); + if (error < 0) + return error; + error = memfd_check_seals_mode(SHMEM_I(inode)->seals, + inode->i_mode, mode); + if (error) + return error; + } + return simple_set_acl(idmap, dentry, acl, type); +} +#else +#define shmem_set_acl NULL +#endif + static const struct inode_operations shmem_inode_operations = { .getattr = shmem_getattr, .setattr = shmem_setattr, #ifdef CONFIG_TMPFS_XATTR .listxattr = shmem_listxattr, - .set_acl = simple_set_acl, + .set_acl = shmem_set_acl, .fileattr_get = shmem_fileattr_get, .fileattr_set = shmem_fileattr_set, #endif Patches currently in -mm which might be from mason@kernel.org are mm-shmem-avoid-moving-the-truncation-start-backwards.patch