[PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[Samiullah Khawaja]

F_SEAL_EXEC prevents the exec bits of a memfd from being changed once
the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so
userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on
shmem memfds, and F_GET_SEALS then reports it as set. However, the check
that rejects the mode change was only added to shmem_setattr().
hugetlbfs_setattr() never looks at the seal, so the owner of a sealed
hugetlbfs memfd can still make it executable with chmod(). For the same
reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with
MFD_HUGETLB.

The memfd selftest already covers this, but only the shmem run passes.
When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because
fchmod() succeeds on a sealed file, and none of the remaining tests are
executed.

Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so
that a mode change touching the exec bits fails with -EPERM while
F_SEAL_EXEC is set.

Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Samiullah Khawaja <skhawaja@xxxxxxxxxx>
---
 fs/hugetlbfs/inode.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 01c4d6f44ebe..56e0588d295d 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
 
 	trace_hugetlbfs_setattr(inode, dentry, attr);
 
+	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
+	    ((inode->i_mode ^ attr->ia_mode) & 0111))
+		return -EPERM;
+
 	if (ia_valid & ATTR_SIZE) {
 		loff_t oldsize = inode->i_size;
 		loff_t newsize = attr->ia_size;

base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651
-- 
2.56.0.307.g5fe7bd680c-goog