[PATCH 2/3] mseal sysmap: Allow with CHECKPOINT_RESTORE, default off
From: Chris Down
Date: Tue Oct 27 2026 - 07:55:36 EST
MSEAL_SYSTEM_MAPPINGS depends on !CHECKPOINT_RESTORE because CRIU moves
system mappings when restoring a process. Now that sealing can be chosen
at boot we should instead use this to determine defaults.
Let's add MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON and move the dependency
there. Existing configurations retain their behaviour. Kernels built
with CHECKPOINT_RESTORE can build sealing in, but will only seal
mappings when explicitly requested with mseal_system_mappings=1.
Hosts can also share a kernel built with MSEAL_SYSTEM_MAPPINGS=y and
MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=n, enabling sealing only where needed.
This lets hosts which need sealing share the kernel image with hosts
which need their system mappings to remain movable, which simplifies
deployment.
Signed-off-by: Chris Down <chris@xxxxxxxxxxxxxx>
---
.../admin-guide/kernel-parameters.txt | 2 +-
Documentation/userspace-api/mseal.rst | 4 +-
mm/mseal.c | 3 +-
security/Kconfig | 17 +++++++-
.../selftests/mseal_system_mappings/Makefile | 2 +
.../selftests/mseal_system_mappings/config | 2 +
.../mseal_system_mappings/sysmap_is_sealed.c | 42 ++++++++++++++++++-
7 files changed, 66 insertions(+), 6 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index b1ec9a8a979e..628f4cccd38e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4275,7 +4275,7 @@ Kernel parameters
whether system mappings are sealed for this boot.
See Documentation/userspace-api/mseal.rst.
Format: <bool>
- Default: 1 (enabled).
+ Default set by CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON.
mtdparts= [MTD]
See drivers/mtd/parsers/cmdlinepart.c
diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst
index 4e50215e4762..c1d6dbb006dc 100644
--- a/Documentation/userspace-api/mseal.rst
+++ b/Documentation/userspace-api/mseal.rst
@@ -143,7 +143,9 @@ Use cases
If supported by an architecture (CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS),
the CONFIG_MSEAL_SYSTEM_MAPPINGS seals all system mappings of this
architecture. The kernel command line parameter
- ``mseal_system_mappings=0`` turns this off at boot.
+ ``mseal_system_mappings=0|1`` turns this off or on at boot. The default is
+ set by CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON, which is off with
+ CONFIG_CHECKPOINT_RESTORE.
WARNING: This feature breaks programs which rely on relocating
or unmapping system mappings. Known broken software at the time
diff --git a/mm/mseal.c b/mm/mseal.c
index e0563796cfa3..8f2f2a149915 100644
--- a/mm/mseal.c
+++ b/mm/mseal.c
@@ -19,7 +19,8 @@
#include "internal.h"
#ifdef CONFIG_MSEAL_SYSTEM_MAPPINGS
-bool mseal_sysmap_enabled __ro_after_init = true;
+bool mseal_sysmap_enabled __ro_after_init =
+ IS_ENABLED(CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON);
static int __init early_mseal_sysmap(char *buf)
{
diff --git a/security/Kconfig b/security/Kconfig
index d5e83af1bfc6..6a6323e0897d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -53,7 +53,6 @@ config MSEAL_SYSTEM_MAPPINGS
bool "mseal system mappings"
depends on 64BIT
depends on ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS
- depends on !CHECKPOINT_RESTORE
help
Apply mseal on system mappings.
The system mappings includes vdso, vvar, vvar_vclock,
@@ -67,11 +66,25 @@ config MSEAL_SYSTEM_MAPPINGS
of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr. Therefore
this config can't be enabled universally.
- Sealing can be turned off at boot with "mseal_system_mappings=0".
+ The "mseal_system_mappings=" kernel command line parameter can
+ be used to enable or disable sealing at boot. The default is set
+ by MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON.
For complete descriptions of memory sealing, please see
Documentation/userspace-api/mseal.rst
+config MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON
+ bool "Seal system mappings by default"
+ depends on MSEAL_SYSTEM_MAPPINGS
+ depends on !CHECKPOINT_RESTORE
+ default y
+ help
+ Sets the default for the "mseal_system_mappings=" boot parameter.
+
+ With CHECKPOINT_RESTORE=y, system mappings are only sealed when
+ "mseal_system_mappings=1" is given, since CRIU needs to move them
+ when restoring a process.
+
config SECURITY
bool "Enable different security models"
depends on SYSFS
diff --git a/tools/testing/selftests/mseal_system_mappings/Makefile b/tools/testing/selftests/mseal_system_mappings/Makefile
index 2b4504e2f52f..d3b88af06c94 100644
--- a/tools/testing/selftests/mseal_system_mappings/Makefile
+++ b/tools/testing/selftests/mseal_system_mappings/Makefile
@@ -1,6 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
CFLAGS += -std=c99 -pthread -Wall $(KHDR_INCLUDES)
+LDLIBS += -lz
+
TEST_GEN_PROGS := sysmap_is_sealed
include ../lib.mk
diff --git a/tools/testing/selftests/mseal_system_mappings/config b/tools/testing/selftests/mseal_system_mappings/config
index 675cb9f37b86..493bbf834a84 100644
--- a/tools/testing/selftests/mseal_system_mappings/config
+++ b/tools/testing/selftests/mseal_system_mappings/config
@@ -1 +1,3 @@
CONFIG_MSEAL_SYSTEM_MAPPINGS=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
diff --git a/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c
index 97348c2a0689..ea75ad537620 100644
--- a/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c
+++ b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c
@@ -10,6 +10,8 @@
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
+#include <sys/utsname.h>
+#include <zlib.h>
#include "kselftest.h"
#include "kselftest_harness.h"
@@ -52,14 +54,52 @@ static int parse_bool(const char *s, bool *res)
return -EINVAL;
}
+static int sysmap_config_expected(int *enabled)
+{
+ struct utsname uts;
+ char line[MAX_LINE_LEN];
+ bool default_on = false;
+ gzFile config;
+ int expected;
+
+ *enabled = -1;
+ config = gzopen("/proc/config.gz", "rb");
+ if (!config && !uname(&uts)) {
+ snprintf(line, sizeof(line), "/boot/config-%s", uts.release);
+ config = gzopen(line, "rb");
+ }
+ if (!config)
+ return -1;
+
+ while (gzgets(config, line, sizeof(line))) {
+ if (!strcmp(line, "CONFIG_MSEAL_SYSTEM_MAPPINGS=y\n"))
+ *enabled = 1;
+ else if (!strcmp(line,
+ "# CONFIG_MSEAL_SYSTEM_MAPPINGS is not set\n"))
+ *enabled = 0;
+ else if (!strcmp(line,
+ "CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=y\n"))
+ default_on = true;
+ }
+ if (!gzeof(config))
+ *enabled = -1;
+ expected = *enabled < 0 ? -1 : *enabled && default_on;
+ gzclose(config);
+ return expected;
+}
+
static int sysmap_sealed_expected(void)
{
char cmdline[4096], *tok, *save;
- int sealed = 1;
+ int enabled, sealed;
bool value;
size_t len;
FILE *f;
+ sealed = sysmap_config_expected(&enabled);
+ if (!enabled)
+ return 0;
+
f = fopen("/proc/cmdline", "r");
if (!f)
return -1;
--
2.54.0