From: Pasha Tatashin <pasha.tatashin@soleen.com>
To: Hugh Dickins <hughd@google.com>,
Baolin Wang <baolin.wang@linux.alibaba.com>,
Andrew Morton <akpm@linux-foundation.org>,
Jeff Xu <jeffxu@google.com>, Kees Cook <kees@kernel.org>,
Pratyush Yadav <pratyush@kernel.org>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Brendan Jackman <jackmanb@google.com>,
Greg Thelen <gthelen@google.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] memfd: deny writeable mappings when implying SEAL_WRITE
Date: Tue, 5 May 2026 15:52:05 +0000 [thread overview]
Message-ID: <afoSC5KUhNwfyWBT@plex> (raw)
In-Reply-To: <177799542165.635180.17809433268620237886.b4-ty@soleen.com>
On 05-05 15:37, Pasha Tatashin wrote:
>
> On Tue, 05 May 2026 15:39:20 +0200, Pratyush Yadav wrote:
> > When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the
> > implied seal is set after the check that makes sure the memfd can not
> > have any writable mappings. This means one can use SEAL_EXEC to apply
> > SEAL_WRITE while having writeable mappings.
> >
> > This breaks the contract that SEAL_WRITE provides and can be used by an
> > attacker to pass a memfd that appears to be write sealed but can still
> > be modified arbitrarily.
> >
> > [...]
>
> Applied, thanks!
>
> [1/1] memfd: deny writeable mappings when implying SEAL_WRITE
> commit: 73f496662a9848021e75742a69a3239ea850c3ee
^^^
Please ignore, this should be Applied to MM tree.
Pasha
>
> Best regards,
> --
> Pasha Tatashin <pasha.tatashin@soleen.com>
>
next prev parent reply other threads:[~2026-05-05 15:52 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-05 13:39 [PATCH] memfd: deny writeable mappings when implying SEAL_WRITE Pratyush Yadav
2026-05-05 15:27 ` Pasha Tatashin
2026-05-05 15:37 ` Pasha Tatashin
2026-05-05 15:52 ` Pasha Tatashin [this message]
2026-05-05 23:54 ` Jeff Xu
2026-05-08 9:37 ` David Hildenbrand (Arm)
2026-05-11 10:52 ` Pratyush Yadav
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=afoSC5KUhNwfyWBT@plex \
--to=pasha.tatashin@soleen.com \
--cc=akpm@linux-foundation.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=gthelen@google.com \
--cc=hughd@google.com \
--cc=jackmanb@google.com \
--cc=jeffxu@google.com \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=pratyush@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.