Re: [RFC PATCH RESEND v2 1/2] mm/memfd: Add support for F_SEAL_FUTURE_EXEC to memfd

[Alice Ryhl]

On Tue, Jan 7, 2025 at 6:21 AM Jeff Xu <jeffxu@xxxxxxxxxxxx> wrote:
> Do you know which code checks for VM_MAYEXEC flag in the mprotect code
> path ?  it isn't obvious to me, i.e. when I grep the VM_MAYEXEC inside
> mm path, it only shows one place in mprotect and that doesn't do the
> work.
>
> ~/mm/mm$ grep VM_MAYEXEC *
> mmap.c: mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
> mmap.c: vm_flags &= ~VM_MAYEXEC;
> mprotect.c: if (rier && (vma->vm_flags & VM_MAYEXEC))
> nommu.c: vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
> nommu.c: vm_flags |= VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;

The check happens here:

/* newflags >> 4 shift VM_MAY% in place of VM_% */
if ((newflags & ~(newflags >> 4)) & VM_ACCESS_FLAGS) {
    error = -EACCES;
    break;
}

Alice