[PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[Samiullah Khawaja]

F_SEAL_EXEC prevents the exec bits of a memfd from being changed once
the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so
userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on
shmem memfds, and F_GET_SEALS then reports it as set. However, the check
that rejects the mode change was only added to shmem_setattr().
hugetlbfs_setattr() never looks at the seal, so the owner of a sealed
hugetlbfs memfd can still make it executable with chmod(). For the same
reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with
MFD_HUGETLB.

The memfd selftest already covers this, but only the shmem run passes.
When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because
fchmod() succeeds on a sealed file, and none of the remaining tests are
executed.

Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so
that a mode change touching the exec bits fails with -EPERM while
F_SEAL_EXEC is set.

Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
Cc: stable@vger.kernel.org
Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
---
 fs/hugetlbfs/inode.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 01c4d6f44ebe..56e0588d295d 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
 
 	trace_hugetlbfs_setattr(inode, dentry, attr);
 
+	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
+	    ((inode->i_mode ^ attr->ia_mode) & 0111))
+		return -EPERM;
+
 	if (ia_valid & ATTR_SIZE) {
 		loff_t oldsize = inode->i_size;
 		loff_t newsize = attr->ia_size;

base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[David Hildenbrand (Arm)]

On 10/26/26 21:55, Samiullah Khawaja wrote:
> F_SEAL_EXEC prevents the exec bits of a memfd from being changed once
> the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so
> userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on
> shmem memfds, and F_GET_SEALS then reports it as set. However, the check
> that rejects the mode change was only added to shmem_setattr().
> hugetlbfs_setattr() never looks at the seal, so the owner of a sealed
> hugetlbfs memfd can still make it executable with chmod(). For the same
> reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with
> MFD_HUGETLB.
> 
> The memfd selftest already covers this, but only the shmem run passes.
> When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because
> fchmod() succeeds on a sealed file, and none of the remaining tests are
> executed.
> 
> Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so
> that a mode change touching the exec bits fails with -EPERM while
> F_SEAL_EXEC is set.
> 
> Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
> Cc: stable@vger.kernel.org
> Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
> ---
>  fs/hugetlbfs/inode.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 01c4d6f44ebe..56e0588d295d 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
>  
>  	trace_hugetlbfs_setattr(inode, dentry, attr);
>  
> +	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
> +	    ((inode->i_mode ^ attr->ia_mode) & 0111))
> +		return -EPERM;
> +
>  	if (ia_valid & ATTR_SIZE) {
>  		loff_t oldsize = inode->i_size;
>  		loff_t newsize = attr->ia_size;
> 
> base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651

https://lore.kernel.org/r/20261026-fixes_shmem-v1-5-703206d5fa0c@kernel.org

-- 
Cheers,

David