Re: [RFC PATCH v2 1/1] exec: seal system mappings

[Oleg Nesterov]

On 10/16, Jeff Xu wrote:
>
> On Wed, Oct 16, 2024 at 6:10 PM Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> wrote:
> >
> > > +     exec.seal_system_mappings = [KNL]
> > > +                     Format: { never | always }
> > > +                     Seal system mappings: vdso, vvar, sigpage, uprobes,
> > > +                     vsyscall.
> > > +                     This overwrites KCONFIG CONFIG_SEAL_SYSTEM_MAPPINGS_*
> > > +                     - 'never':  never seal system mappings.
> >
> > Not true, uprobes are sealed when 'never' is selected.
> >
> Thanks. I forgot to uprobes from the description in Kconfig and
> kernel-parameters.txt, will update.

Jeff, I am sorry for confusion.

No need to make uprobes "special" and complicate the logic/documentation.

I just meant that, unlike vdso, it is always safe/good to mseal the "[uprobes]"
vma, regardless of config/boot options.

Please do what you think is right, I am fine either way.

Oleg.