Re: [PATCH v2] man/man2/memfd_secret.2: Update default state

Alejandro Colomar
2025-05-01T21:21:25Z

[-- Attachment #1: Type: text/plain, Size: 2627 bytes --]

Hi

On Mon, Apr 28, 2025 at 12:02:52PM +1000, Thiébaud Weksteen wrote:
> In commit b758fe6df50 ("mm/secretmem: make it on by default"),
> memfd_secret was updated to be enabled by default.
>
> Signed-off-by: Thiébaud Weksteen <tweek@google.com>

Thanks! I've applied the patch. I've amended with some tweaks to line
breaks to reduce the diff:

diff --git c/man/man2/memfd_secret.2 w/man/man2/memfd_secret.2
index b3896b12d..30853d65b 100644
--- c/man/man2/memfd_secret.2
+++ w/man/man2/memfd_secret.2
@@ -140,9 +140,9 @@ .SH HISTORY
Before Linux 6.5,
.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2
.BR memfd_secret ()
-was disabled by default and only available if the system
-administrator turned it on using "secretmem.enable=y" kernel
-parameter.
+was disabled by default and only available
+if the system administrator turned it on using
+"secretmem.enable=y" kernel parameter.
.SH NOTES
The
.BR memfd_secret ()

<https://www.alejandro-colomar.es/src/alx/linux/man-pages/man-pages.git/commit/?h=contrib&id=84521911eab71ce5ff83365c75dfce846d12ce97>

Have a lovely night!
Alex

> ---
> Changes since v1:
> - Move the paragraph to the HISTORY section.
> - Drop reference to the performance concern.
> - Follow semantic newlines rule.
> man/man2/memfd_secret.2 | 14 +++++++-------
> 1 file changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
> index 322d67a41..b3896b12d 100644
> --- a/man/man2/memfd_secret.2
> +++ b/man/man2/memfd_secret.2
> @@ -136,6 +136,13 @@ or has not been enabled on the kernel command-line with
> Linux.
> .SH HISTORY
> Linux 5.14.
> +.P
> +Before Linux 6.5,
> +.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2
> +.BR memfd_secret ()
> +was disabled by default and only available if the system
> +administrator turned it on using "secretmem.enable=y" kernel
> +parameter.
> .SH NOTES
> The
> .BR memfd_secret ()
> @@ -182,13 +189,6 @@ or spawn a new privileged user-space process to perform
> secrets exfiltration using
> .BR ptrace (2).
> .P
> -The way
> -.BR memfd_secret ()
> -allocates and locks the memory may impact overall system performance,
> -therefore the system call is disabled by default and only available
> -if the system administrator turned it on using
> -"secretmem.enable=y" kernel parameter.
> -.P
> To prevent potential data leaks of memory regions backed by
> .BR memfd_secret ()
> from a hybernation image,
> --
> 2.49.0.850.g28803427d3-goog
>

--
<https://www.alejandro-colomar.es/>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]