This RFC adds two syscalls, pidfd_mmap() and pidfd_munmap(), that let a
supervisor install or remove a mapping in another process's address space
without target-side cooperation, and converts User Mode Linux to use them.
pidfd_mmap(int pidfd, struct pidfd_mmap_args *uargs, unsigned int flags)
pidfd_munmap(int pidfd, unsigned long addr, unsigned long len)
The backing fd (if any) is resolved in the *caller's* fd table, mirroring
pidfd_getfd()'s cross-task install model. Both are gated by
ptrace_may_access(PTRACE_MODE_ATTACH_REALCREDS); LSM/fsnotify hooks run
against the caller. pidfd_mmap() takes an extensible, size-versioned
argument struct (clone3/openat2 style) since an mmap-shaped call exceeds
the 6-argument syscall limit.
They build on the mm-side remote-install primitives vm_mmap_remote()/
vm_munmap_remote(), posted separately as:
https://lore.kernel.org/all/20260704231831.354543-2-xiyou.wangcong@gmail.com/
UML is the motivating user. Its SKAS monitor previously installed guest
mappings by driving the stub to execute mmap/munmap itself: in seccomp
mode it passed the physmem fd to the stub over SCM_RIGHTS, and in ptrace
mode it batched STUB_SYSCALL_MMAP/MUNMAP entries for the stub to run.
pidfd_mmap() lets the monitor install mappings into the stub's mm
directly, so the stub never touches the fd or executes mmap/munmap. With
both modes converted, the entire stub-syscall batcher and the SCM_RIGHTS
fd-passing become dead code and are removed (net ~530 lines). The ptrace
conversion (patch 5) is included mainly to demonstrate the primitive's
reach; the security caveats pidfd_mmap() does *not* address (e.g. a guest
blocking SIGALRM to dodge scheduling) are preserved in stub.c.
As this is an RFC, the UML side _intentionally_ does not handle host
portability: it assumes a host kernel that provides pidfd_mmap() and
deliberately omits any detection or fallback for older hosts (which would
otherwise pick the ptrace path, or fail the seccomp probe). That belongs
in a non-RFC version and is left out here to keep the series focused on
demonstrating the impact on UML.
---
Cong Wang (6):
pidfd: add pidfd_mmap()/pidfd_munmap() syscalls
um: acquire a stub pidfd via CLONE_PIDFD in seccomp mode
um: install guest mappings via pidfd_mmap() in seccomp mode
um: forbid mmap/munmap in the stub seccomp filter
um: install guest mappings via pidfd_mmap() in both modes
selftests/pidfd: add pidfd_mmap()/pidfd_munmap() tests
arch/um/include/shared/os.h | 4 -
arch/um/include/shared/skas/mm_id.h | 8 +-
arch/um/include/shared/skas/stub-data.h | 28 --
arch/um/kernel/skas/mmu.c | 9 +-
arch/um/kernel/skas/stub.c | 151 ++--------
arch/um/kernel/skas/stub_exe.c | 20 +-
arch/um/os-Linux/skas/mem.c | 275 ++----------------
arch/um/os-Linux/skas/process.c | 92 ++----
arch/um/os-Linux/start_up.c | 8 +-
arch/x86/entry/syscalls/syscall_64.tbl | 2 +
include/linux/syscalls.h | 5 +
include/uapi/linux/pidfd.h | 18 ++
kernel/pid.c | 132 +++++++++
scripts/syscall.tbl | 2 +
tools/testing/selftests/pidfd/Makefile | 3 +-
tools/testing/selftests/pidfd/pidfd.h | 34 +++
.../testing/selftests/pidfd/pidfd_mmap_test.c | 234 +++++++++++++++
17 files changed, 520 insertions(+), 505 deletions(-)
create mode 100644 tools/testing/selftests/pidfd/pidfd_mmap_test.c
base-commit: 69288464b0af40a988958c0e1b29ff15ccd2acb7
--
2.43.0