Re: [PATCH] prctl: require checkpoint_restore_ns_capable for PR_SET_MM_MAP

[Qi Tang <tpluszz77@gmail.com>]

Thanks for the detailed review, and sorry for the noise on the
SELinux angle. file_map_prot_check() still enforces
PROCESS__EXECMEM, so that bypass doesn't work.

You're right that gating the entire PR_SET_MM_MAP call is too
broad and could break existing users that only update harmless
fields like arg_start/arg_end.

The intent was to address the case where exe_fd is -1: the
existing checkpoint_restore_ns_capable() check only fires when
exe_fd != (u32)-1, so updating mm boundaries alone has no
permission check.

As noted in this thread, the man page also states PR_SET_MM
requires CAP_SYS_RESOURCE, and the individual field path
enforces that, but the MAP path does not. Is this inconsistency
intentional?

Qi Tang