From: Jeff Xu <jeffxu@chromium.org>
Update memory sealing documentation to include details about system
mappings.
Signed-off-by: Jeff Xu <jeffxu@chromium.org>
Reviewed-by: Kees Cook <kees@kernel.org>
---
Documentation/userspace-api/mseal.rst | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst
index 41102f74c5e2..10147281bf2d 100644
--- a/Documentation/userspace-api/mseal.rst
+++ b/Documentation/userspace-api/mseal.rst
@@ -130,6 +130,13 @@ Use cases
- Chrome browser: protect some security sensitive data structures.
+- System mappings:
+ If supported by an architecture (via CONFIG_ARCH_HAS_MSEAL_SYSTEM_MAPPINGS),
+ the CONFIG_MSEAL_SYSTEM_MAPPINGS seals system mappings, e.g. vdso, vvar,
+ uprobes, sigpage, vectors, etc. CHECKPOINT_RESTORE, UML, gVisor, rr are
+ known to relocate or unmap system mapping, therefore this config can't be
+ enabled universally.
+
When not to use mseal
=====================
Applications can apply sealing to any virtual memory region from userspace,
--
2.48.1.658.g4767266eb4-goog