Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL #4315

Open
kdrag0n opened this issue May 29, 2023 · 2 comments · May be fixed by #4378
Open

memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL #4315

kdrag0n opened this issue May 29, 2023 · 2 comments · May be fixed by #4378

Comments

@kdrag0n
Copy link

kdrag0n commented May 29, 2023

Linux kernel 6.3+ wants either the MFD_EXEC or MFD_NOEXEC_SEAL flag to be passed to memfd_create in order to seal the executable bit at creation time:

[    1.229444] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=851 'lxd'

Updating the memfd_create calls should be fairly straightforward (all MFD_NOEXEC_SEAL at a glance except for rexec.c), but a compatibility header is probably also necessary because these flags are new.
@tew42
Copy link

tew42 commented Nov 5, 2023

just upgraded to 6.5 kernel, noticed this begin to appear as well

@devZer0
Copy link

devZer0 commented Dec 28, 2023

this problem also applies to kvm ( https://forum.proxmox.com/threads/kernel-6-5-memfd_create-called-without-mfd_exec-or-mfd_noexec_seal-set.138828/#post-619818 )

here is some in depth description

https://lwn.net/Articles/918106/

kdrag0n added a commit to kdrag0n/lxc that referenced this issue Dec 28, 2023
@kdrag0n
tree-wide: add MFD_EXEC and MFD_NOEXEC_SEAL flags to memfd_create
b683d16 
Since Linux kernel 6.3, one of these flags must be passed to avoid a
warning being printed in the kernel log:

[    1.229444] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=851 'lxd'

Fixes lxc#4315

Signed-off-by: Danny Lin <danny@kdrag0n.dev>
@kdrag0n kdrag0n linked a pull request Dec 28, 2023 that will close this issue
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

tree-wide: add MFD_EXEC and MFD_NOEXEC_SEAL flags to memfd_create kdrag0n/lxc
3 participants
@tew42 @devZer0 @kdrag0n