From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-bc0b.mail.infomaniak.ch (smtp-bc0b.mail.infomaniak.ch [45.157.188.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A806B2EE5FE for ; Fri, 22 Aug 2025 17:08:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.157.188.11 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755882501; cv=none; b=l0W3W1dGBixtuzzM60yVoEGEmnv3bWzaXDESfAEYxkGMm0zUzU6lxvu8BmLUGj0w9ImWqt0dNSBsIv5THLm0m6WFt/8XjWJ+UXRhAxgkykepoQPQY7KRCqgMI/lw1ApTt08MpJINR0Q7IrbzKrOneffksiVGzIJspPHTM5oL9xw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755882501; c=relaxed/simple; bh=V2ZTsarFg/J8E5OaQui6bJ/rqih15nGa1jJfmYgVI1U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=drrguibY5Y57e3IaYdlFpooNJ8JqcD4DSatwGMBIfXk74H3zOTKgHBHwFTHHxTxxwk5cp9ohBnedIv58xRm2EWYo+9FqmMsEgw4ZGthuQ2wb4W9UDDL6Vx4p0Pd7yMkAJOR9a/p3n0u1+uJApStasu+b988/g1uNd+CeMYq0y60= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=hG5HIpVS; arc=none smtp.client-ip=45.157.188.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="hG5HIpVS" Received: from smtp-4-0001.mail.infomaniak.ch (unknown [IPv6:2001:1600:7:10::a6c]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4c7mpy134kzxXK; Fri, 22 Aug 2025 19:08:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1755882489; bh=NUlPE+heYCOxk91D6n6N1q+wkFLg9BAFfbEyk2M2p7s=; h=From:To:Cc:Subject:Date:From; b=hG5HIpVSutSZRtsFd06T355DYxH9qGfeUrqxCfDId/uv7nj6uXVjPRBf18tBMYdh4 J6MiUTTm1h4vs8d4xuZbZYXJlYRjshhhkRv5DqPl8As0hFQMoU8Fji4LbbavOEzeD6 pu8JGqfHl0XehVrNxAaaC0/jXXueFPe5Q8Oj6srA= Received: from unknown by smtp-4-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4c7mpw1MlWzprv; Fri, 22 Aug 2025 19:08:08 +0200 (CEST) From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= To: Al Viro , Christian Brauner , Kees Cook , Paul Moore , Serge Hallyn Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Andy Lutomirski , Arnd Bergmann , Christian Heimes , Dmitry Vyukov , Elliott Hughes , Fan Wu , Florian Weimer , Jann Horn , Jeff Xu , Jonathan Corbet , Jordan R Abrahams , Lakshmi Ramasubramanian , Luca Boccassi , Matt Bobrowski , Miklos Szeredi , Mimi Zohar , Nicolas Bouchinet , Robert Waite , Roberto Sassu , Scott Shell , Steve Dower , Steve Grubb , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [RFC PATCH v1 0/2] Add O_DENY_WRITE (complement AT_EXECVE_CHECK) Date: Fri, 22 Aug 2025 19:07:58 +0200 Message-ID: <20250822170800.2116980-1-mic@digikod.net> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Infomaniak-Routing: alpha Hi, Script interpreters can check if a file would be allowed to be executed by the kernel using the new AT_EXECVE_CHECK flag. This approach works well on systems with write-xor-execute policies, where scripts cannot be modified by malicious processes. However, this protection may not be available on more generic distributions. The key difference between `./script.sh` and `sh script.sh` (when using AT_EXECVE_CHECK) is that execve(2) prevents the script from being opened for writing while it's being executed. To achieve parity, the kernel should provide a mechanism for script interpreters to deny write access during script interpretation. While interpreters can copy script content into a buffer, a race condition remains possible after AT_EXECVE_CHECK. This patch series introduces a new O_DENY_WRITE flag for use with open*(2) and fcntl(2). Both interfaces are necessary since script interpreters may receive either a file path or file descriptor. For backward compatibility, open(2) with O_DENY_WRITE will not fail on unsupported systems, while users requiring explicit support guarantees can use openat2(2). The check_exec.rst documentation and related examples do not mention this new feature yet. Regards, Mickaël Salaün (2): fs: Add O_DENY_WRITE selftests/exec: Add O_DENY_WRITE tests fs/fcntl.c | 26 ++- fs/file_table.c | 2 + fs/namei.c | 6 + include/linux/fcntl.h | 2 +- include/uapi/asm-generic/fcntl.h | 4 + tools/testing/selftests/exec/check-exec.c | 219 ++++++++++++++++++++++ 6 files changed, 256 insertions(+), 3 deletions(-) base-commit: c17b750b3ad9f45f2b6f7e6f7f4679844244f0b9 -- 2.50.1