This extends the current PR_SET_MDWE prctl arg with a bit to indicate that the process doesn't want MDWE protection to propagate to children. To implement this no-inherit mode, the tag in current->mm->flags must be absent from MMF_INIT_MASK. This means that the encoding for "MDWE but without inherit" is different in the prctl than in the mm flags. This leads to a bit of bit-mangling in the prctl implementation.
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -284,6 +284,7 @@ struct prctl_mm_map { · 283 unmodified lines | |||
| 284 | /* Memory deny write / execute */ | 284 | /* Memory deny write / execute */ |
| 285 | #define PR_SET_MDWE 65 | 285 | #define PR_SET_MDWE 65 |
| 286 | # define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) | 286 | # define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) |
| 287 | # define PR_MDWE_NO_INHERIT (1UL << 1) | ||
| 287 | 288 | ||
| 288 | #define PR_GET_MDWE 66 | 289 | #define PR_GET_MDWE 66 |
| 289 | 290 | ||