On Fri, Mar 9, 2018 at 10:48 AM, Andy Lutomirski <l...@amacapital.net> wrote:
>> On Mar 9, 2018, at 10:17 AM, Linus Torvalds <torva...@linux-foundation.org>
>> wrote:
>>
>> Hmm. I wish we had an "execute blob" model, but we really don't, and
>> it would be hard/impossible to do without pinning the pages in memory.
>>
>
> Why so hard? We can already execute a struct file for execveat, and Alexei
> already has this working for umh.
> Surely we can make an immutable (as in even root can’t write it)
> kernel-internal tmpfs file, execveat it, then unlink it.
And what do you think that does? It pins the memory for the whole
time. As a *copy* of the original file.
Anyway, see my other suggestion that makes this all irrelevant. Just
wait synchronously (until the exit), and just use deny_write_access().
The "synchronous wait" means that you don't have the semantic change
(and really., it's *required* anyway for the whole mutual exclusion
against another thread racing to load the same module), and the
deny_write_access() means that we don't neeed to make another copy.
Linus
