[PATCH v2] man/man2/memfd_secret.2: Update default state

Thiébaud Weksteen
2025-04-28T02:02:58Z

In commit b758fe6df50 ("mm/secretmem: make it on by default"),
memfd_secret was updated to be enabled by default.

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
---
Changes since v1:
- Move the paragraph to the HISTORY section.
- Drop reference to the performance concern.
- Follow semantic newlines rule.
man/man2/memfd_secret.2 | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
index 322d67a41..b3896b12d 100644
--- a/man/man2/memfd_secret.2
+++ b/man/man2/memfd_secret.2
@@ -136,6 +136,13 @@ or has not been enabled on the kernel command-line with
Linux.
.SH HISTORY
Linux 5.14.
+.P
+Before Linux 6.5,
+.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2
+.BR memfd_secret ()
+was disabled by default and only available if the system
+administrator turned it on using "secretmem.enable=y" kernel
+parameter.
.SH NOTES
The
.BR memfd_secret ()
@@ -182,13 +189,6 @@ or spawn a new privileged user-space process to perform
secrets exfiltration using
.BR ptrace (2).
.P
-The way
-.BR memfd_secret ()
-allocates and locks the memory may impact overall system performance,
-therefore the system call is disabled by default and only available
-if the system administrator turned it on using
-"secretmem.enable=y" kernel parameter.
-.P
To prevent potential data leaks of memory regions backed by
.BR memfd_secret ()
from a hybernation image,
--
2.49.0.850.g28803427d3-goog