From: sashiko-bot@kernel.org
Cc: linux-security-module@vger.kernel.org
Subject: Re: [PATCH 2/3] mseal sysmap: Allow with CHECKPOINT_RESTORE, default off
Date: Wed, 28 Oct 2026 11:43:35 +0000 [thread overview]
Message-ID: <sashiko-outbox-187838@kernel.org> (raw)
In-Reply-To: <7ff59c2ab6c234ca4d799f862eb7c3f22d671f99.1793094611.git.chris@chrisdown.name>
> MSEAL_SYSTEM_MAPPINGS depends on !CHECKPOINT_RESTORE because CRIU moves
> system mappings when restoring a process. Now that sealing can be chosen
> at boot we should instead use this to determine defaults.
>
> Let's add MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON and move the dependency
> there. Existing configurations retain their behaviour. Kernels built
> with CHECKPOINT_RESTORE can build sealing in, but will only seal
> mappings when explicitly requested with mseal_system_mappings=1.
>
> Hosts can also share a kernel built with MSEAL_SYSTEM_MAPPINGS=y and
> MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=n, enabling sealing only where needed.
> This lets hosts which need sealing share the kernel image with hosts
> which need their system mappings to remain movable, which simplifies
> deployment.
>
> Signed-off-by: Chris Down <chris@chrisdown.name>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1793094611.git.chris@chrisdown.name?part=2
next prev parent reply other threads:[~2026-10-28 11:43 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 11:42 [PATCH 0/3] mseal sysmap: Choose system mapping sealing at boot Chris Down
2026-10-27 11:43 ` [PATCH 1/3] mseal sysmap: Add mseal_system_mappings= boot parameter Chris Down
2026-10-27 14:53 ` Lorenzo Stoakes (ARM)
2026-10-27 16:37 ` Chris Down
2026-10-27 16:57 ` Lorenzo Stoakes (ARM)
2026-10-28 4:30 ` Jeff Xu
2026-10-28 5:52 ` Chris Down
2026-10-28 5:55 ` Chris Down
2026-10-28 6:16 ` Jeff Xu
2026-10-28 9:49 ` Lorenzo Stoakes (ARM)
2026-10-28 11:43 ` sashiko-bot
2026-10-28 12:18 ` Pedro Falcato
2026-10-27 11:43 ` [PATCH 2/3] mseal sysmap: Allow with CHECKPOINT_RESTORE, default off Chris Down
2026-10-27 14:57 ` Lorenzo Stoakes (ARM)
2026-10-27 16:37 ` Chris Down
2026-10-27 16:59 ` Lorenzo Stoakes (ARM)
2026-10-28 11:43 ` sashiko-bot [this message]
2026-10-27 11:43 ` [PATCH 3/3] selftests/mseal_system_mappings: Test vdso unmap and remap Chris Down
2026-10-27 15:03 ` Lorenzo Stoakes (ARM)
2026-10-27 16:40 ` Chris Down
2026-10-27 17:02 ` Lorenzo Stoakes (ARM)
2026-10-28 11:43 ` sashiko-bot
2026-10-28 15:34 ` [PATCH 0/3] mseal sysmap: Choose system mapping sealing at boot Andrei Vagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-187838@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.