From: Chris Down <chris@chrisdown.name>
To: Andrew Morton <akpm@linux-foundation.org>,
"Liam R. Howlett" <liam@infradead.org>,
Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>, Jann Horn <jannh@google.com>,
Pedro Falcato <pfalcato@suse.de>,
David Hildenbrand <david@kernel.org>, Kees Cook <kees@kernel.org>,
Jeff Xu <jeffxu@chromium.org>, Andrey Vagin <avagin@gmail.com>,
Alexander Mikhalitsyn <alexander@mihalicyn.com>,
Paul Moore <paul@paul-moore.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Shuah Khan <shuah@kernel.org>, Jonathan Corbet <corbet@lwn.net>,
linux-mm@kvack.org, linux-hardening@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kselftest@vger.kernel.org, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org, kernel-team@meta.com
Subject: [PATCH 0/3] mseal sysmap: Choose system mapping sealing at boot
Date: Tue, 27 Oct 2026 19:42:54 +0800 [thread overview]
Message-ID: <cover.1793094611.git.chris@chrisdown.name> (raw)
System mapping sealing is currently a build time choice. Hosts which
want it and hosts which need to move or unmap these mappings therefore
need separate kernels, which is not ideal. Let's allow the administrator
to choose at boot time.
Chris Down (3):
mseal sysmap: Add mseal_system_mappings= boot parameter
mseal sysmap: Allow with CHECKPOINT_RESTORE, default off
selftests/mseal_system_mappings: Test vdso unmap and remap
.../admin-guide/kernel-parameters.txt | 7 +
Documentation/userspace-api/mseal.rst | 5 +-
include/linux/mm.h | 3 +-
mm/mseal.c | 13 +
security/Kconfig | 17 +-
.../selftests/mseal_system_mappings/Makefile | 2 +
.../selftests/mseal_system_mappings/config | 2 +
.../mseal_system_mappings/sysmap_is_sealed.c | 236 ++++++++++++++++--
8 files changed, 268 insertions(+), 17 deletions(-)
base-commit: bae9a042b03b27924c6fd5bdc00a20d6a44d6041
--
2.54.0
next reply other threads:[~2026-10-27 11:43 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 11:42 Chris Down [this message]
2026-10-27 11:43 ` [PATCH 1/3] mseal sysmap: Add mseal_system_mappings= boot parameter Chris Down
2026-10-27 14:53 ` Lorenzo Stoakes (ARM)
2026-10-27 16:37 ` Chris Down
2026-10-27 16:57 ` Lorenzo Stoakes (ARM)
2026-10-27 11:43 ` [PATCH 2/3] mseal sysmap: Allow with CHECKPOINT_RESTORE, default off Chris Down
2026-10-27 14:57 ` Lorenzo Stoakes (ARM)
2026-10-27 16:37 ` Chris Down
2026-10-27 16:59 ` Lorenzo Stoakes (ARM)
2026-10-27 11:43 ` [PATCH 3/3] selftests/mseal_system_mappings: Test vdso unmap and remap Chris Down
2026-10-27 15:03 ` Lorenzo Stoakes (ARM)
2026-10-27 16:40 ` Chris Down
2026-10-27 17:02 ` Lorenzo Stoakes (ARM)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1793094611.git.chris@chrisdown.name \
--to=chris@chrisdown.name \
--cc=akpm@linux-foundation.org \
--cc=alexander@mihalicyn.com \
--cc=avagin@gmail.com \
--cc=corbet@lwn.net \
--cc=david@kernel.org \
--cc=jannh@google.com \
--cc=jeffxu@chromium.org \
--cc=jmorris@namei.org \
--cc=kees@kernel.org \
--cc=kernel-team@meta.com \
--cc=liam@infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-security-module@vger.kernel.org \
--cc=ljs@kernel.org \
--cc=paul@paul-moore.com \
--cc=pfalcato@suse.de \
--cc=serge@hallyn.com \
--cc=shuah@kernel.org \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox