System mapping sealing is currently a build time choice. Hosts which want it and hosts which need to move or unmap these mappings therefore need separate kernels, which is not ideal. Let's allow the administrator to choose at boot time.
v2: - Skip destructive vDSO tests on unsealed 32-bit x86 mappings - Move the sysmap tests into selftests/mm (Lorenzo) - Use shared vm_util helpers in the sysmap tests (Lorenzo) - Use PROCMAP_QUERY for the vDSO lookup (Lorenzo) - Keep test changes in separate patches (Lorenzo) - Put the enforcement tests before the kernel changes (Lorenzo) - Move MSEAL_SYSTEM_MAPPINGS to mm/Kconfig (Lorenzo) - Remove VM_SEALED_SYSMAP (Lorenzo) - Seal mappings in __install_special_mapping() (Lorenzo) - Leave a sealed uprobe trampoline mapped if optimisation fails - Replace the boolean parameter with no_mseal_sys_mappings (Lorenzo) - Drop MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON (Lorenzo) - Drop the CHECKPOINT_RESTORE dependency (Lorenzo) - Document the software which sealing breaks (Lorenzo) - Keep Kconfig default-n regardless of CHECKPOINT_RESTORE (Andrei) - Retain sealing by default when built in, with no_mseal_sys_mappings as the boot-time opt-out (Lorenzo) - Explain the security rationale (Lorenzo) - Describe the Meta/Reverie use case (Lorenzo) - Skip general checks on unsealed kernels (Lorenzo) - Add expect_sealed for strict CI checks (Jeff) - Use the existing -T filter to exclude strict checks when needed (Jeff) - Test that no_mseal_sys_mappings leaves mappings unsealed (Jeff) - Add the vDSO mprotect() enforcement test (Jeff) v1: https://lore.kernel.org/r/[email protected] Chris Down (8): selftests/mm: Move sysmap_is_sealed into mm selftests/mm: Skip sysmap_is_sealed when system mappings aren't sealed selftests/mm: Test that the seal on system mappings is enforced mm/mseal: Move MSEAL_SYSTEM_MAPPINGS to mm/Kconfig uprobes/x86: Leave sealed trampolines in place on optimisation failure mm/mseal: Seal system mappings in __install_special_mapping() mm/mseal: Add no_mseal_sys_mappings boot parameter selftests/mm: Check that no_mseal_sys_mappings unseals system mappings .../admin-guide/kernel-parameters.txt | 7 + Documentation/userspace-api/mseal.rst | 12 +- arch/arm64/kernel/vdso.c | 9 +- arch/loongarch/kernel/vdso.c | 3 +- arch/riscv/kernel/vdso.c | 2 +- arch/s390/kernel/vdso.c | 2 +- arch/x86/entry/vdso/vma.c | 5 +- arch/x86/kernel/uprobes.c | 2 +- include/linux/mm.h | 6 - init/Kconfig | 5 +- kernel/events/uprobes.c | 2 +- lib/vdso/datastore.c | 2 +- mm/Kconfig | 23 ++ mm/mseal.c | 12 + mm/vma.c | 2 + mm/vma.h | 8 + security/Kconfig | 21 -- tools/testing/selftests/Makefile | 1 - tools/testing/selftests/mm/Makefile | 1 + tools/testing/selftests/mm/config | 1 + tools/testing/selftests/mm/run_vmtests.sh | 6 + tools/testing/selftests/mm/sysmap_is_sealed.c | 259 ++++++++++++++++++ tools/testing/selftests/mm/vm_util.c | 5 + tools/testing/selftests/mm/vm_util.h | 1 + .../mseal_system_mappings/.gitignore | 2 - .../selftests/mseal_system_mappings/Makefile | 6 - .../selftests/mseal_system_mappings/config | 1 - .../mseal_system_mappings/sysmap_is_sealed.c | 119 -------- 28 files changed, 345 insertions(+), 180 deletions(-) create mode 100644 tools/testing/selftests/mm/sysmap_is_sealed.c delete mode 100644 tools/testing/selftests/mseal_system_mappings/.gitignore delete mode 100644 tools/testing/selftests/mseal_system_mappings/Makefile delete mode 100644 tools/testing/selftests/mseal_system_mappings/config delete mode 100644 tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c base-commit: 734a9da61a5bc5d82b496a86bacc097d11dc6871 -- 2.54.0
