From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=115.124.30.130 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793072743; b=OM2AuRBAngAZh1/iEsNVrYtFUG4R2CA+m3yyW3PHPXDtU7GzMNSLfVpVgpolB0cgs5Xc EslTgqjJjx5vEdAGDmTLwOsySejb8fPBrlh0ubmMLxxAXVN3bQbTWc445Op5YkAj/c+rp IwBWcynsha7zRssvYEKCrqSagORMzPNfhLHWiwWwsLozlK0+6hOX4AUIZvsVuNFxPSrQf VLc95tnmWFu9sPq0IcqdlC5GSqvIMe1yt6JBVFxTYV2gnOkRqla9VMmllDBTAGdXd83Wk UfqHwsjw3f10Mx543BIDbIdDoe3fAg2eZEnPbYFvsSvGOGrT3T6aLOVRMBK7xHrU1ug== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793072743; h=DMARC-Filter:DKIM-Signature:X-Alimail-AntiSpam:Received:Message-ID: Date:MIME-Version:User-Agent:Subject:To:Cc:References:From: In-Reply-To:Content-Type:Content-Transfer-Encoding; bh=eblZIxYX7VzLbXt+5qoHuQCynpNoCaK48F6B5iELuyc=; b=i/ffn91KTs5sDKxmifZgNXAD2yTgZsj9vj7Nnd2U3PHYgcsTNh8fYxY0P6HA+7rJ6Srk qinVjddq1dr4uiWzQO3tJknQYDB3kK6TZiLR9eS+m2Gct4YwID7VRuSw0rLAxmI+IdC9J TdIEo3qybQtVer6jzqUzIt3Q2JFHfDunmSdA5S3Olgq7yHfPhqrpi11bl+tBol2OdZB+R HpQan+0j8X48VRazV6CBw6mEe8rZui1whEqxqPioqXHw9UNuEUD5SNtPxUmzv345ukVKn LWq60tjfSFJyHc/Sg7EhKHECdtyWuZFlSiIXCetRUT3o3Er3J8EHxaFuUINa3AK3uPw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass header.d=linux.alibaba.com header.i=@linux.alibaba.com header.a=rsa-sha256 header.s=default header.b=oT1hdyOE; arc=none smtp.remote-ip=115.124.30.130 Received: from out30-130.freemail.mail.aliyun.com (out30-130.freemail.mail.aliyun.com [115.124.30.130]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A184606A31D; Tue, 27 Oct 2026 03:45:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9A184606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.a=rsa-sha256 header.s=default header.b=oT1hdyOE DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1793072732; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=eblZIxYX7VzLbXt+5qoHuQCynpNoCaK48F6B5iELuyc=; b=oT1hdyOEniPo/bkii21MiJda2f4xF6Z4ZfAODTASY54plFkd6LS1TQJL6Yh6cbZjmejtEPY7UvCpdmhsz3W/eRMYZU12eGjYhV7JvZqZxdhuZndhhb1YcWsEh97EzyC5nG04jgOhRc8D19mdoB1XY+a1YqQEodW0QwYAjSPcpjU= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R461e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033032089153;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=31;SR=0;TI=SMTPD_---0XDcSv8H_1793072727; Received: from 30.74.144.191(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0XDcSv8H_1793072727 cluster:ay36) by smtp.aliyun-inc.com; Tue, 27 Oct 2026 11:45:29 +0800 Message-ID: Date: Tue, 27 Oct 2026 11:45:26 +0800 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 04/16] mm/shmem: honour F_SEAL_EXEC when an ACL is set To: "David Hildenbrand (Arm)" , Andrew Morton , Gregory Price , Zi Yan , Joshua Hahn , Rakie Kim , Ying Huang , Johannes Weiner , Vladimir Davydov , Michal Hocko , Hugh Dickins , Lukas Czerner , Carlos Maiolino , Christian Brauner , Jan Kara , Daniel Verkamp , Jeff Xu , Muchun Song , Oscar Salvador , David Stevens , "Matthew Wilcox (Oracle)" , William Kucharski , Chris Li , Kairui Song , Nhat Pham , Miaohe Lin , Naoya Horiguchi Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Chris Mason , stable@vger.kernel.org References: <20261026-fixes_shmem-v1-0-703206d5fa0c@kernel.org> <20261026-fixes_shmem-v1-4-703206d5fa0c@kernel.org> From: Baolin Wang In-Reply-To: <20261026-fixes_shmem-v1-4-703206d5fa0c@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 10/26/26 5:40 PM, David Hildenbrand (Arm) wrote: > From: Chris Mason > > The owner of a memfd sealed with F_SEAL_EXEC can still change its > execute bits by setting a POSIX access ACL. With CONFIG_TMPFS_POSIX_ACL, > this lets an unprivileged owner make a non-executable memfd executable, > bypassing vm.memfd_noexec=2. > > simple_set_acl() updates i_mode directly, bypassing the seal check in > shmem_setattr(). Add shmem_set_acl() to check the resulting mode. Share > the F_SEAL_EXEC check with shmem_setattr() using memfd_check_seals_mode() > in include/linux/memfd.h. > > Fix generated by an LLM and sent by Chris Mason in private. > > Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC") > Cc: stable@vger.kernel.org > Signed-off-by: Chris Mason > [ david: use common helper; simplify description ] > Signed-off-by: David Hildenbrand (Arm) > --- Make sense to me. Reviewed-by: Baolin Wang