Re: [PATCH] memfd: deny writeable mappings when implying SEAL_WRITE

[Pasha Tatashin]

On Tue, 05 May 2026 15:39:20 +0200, Pratyush Yadav wrote:
> When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the
> implied seal is set after the check that makes sure the memfd can not
> have any writable mappings. This means one can use SEAL_EXEC to apply
> SEAL_WRITE while having writeable mappings.
> 
> This breaks the contract that SEAL_WRITE provides and can be used by an
> attacker to pass a memfd that appears to be write sealed but can still
> be modified arbitrarily.
> 
> [...]

Applied, thanks!

[1/1] memfd: deny writeable mappings when implying SEAL_WRITE
      commit: 73f496662a9848021e75742a69a3239ea850c3ee

Best regards,
-- 
Pasha Tatashin <pasha.tatashin@xxxxxxxxxx>