lkml.org 
[lkml]   [2020]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 3/4] aarch64: Use mmap to add PROT_BTI instead of mprotect [BZ #26831]
    Date
    * Szabolcs Nagy:

    > Re-mmap executable segments if possible instead of using mprotect
    > to add PROT_BTI. This allows using BTI protection with security
    > policies that prevent mprotect with PROT_EXEC.
    >
    > If the fd of the ELF module is not available because it was kernel
    > mapped then mprotect is used and failures are ignored. It is
    > expected that linux kernel will add PROT_BTI when mapping a module
    > (current linux as of version 5.9 does not do this).
    >
    > Computing the mapping parameters follows the logic of
    > _dl_map_object_from_fd more closely now.

    What's the performance of this on execve-heavy workloads, such as kernel
    or glibc builds? Hopefully it's cheap because these mappings have not
    been faulted in yet.

    Thanks,
    Florian
    --
    Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn,
    Commercial register: Amtsgericht Muenchen, HRB 153243,
    Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill

    \
     
     \ /
      Last update: 2020-11-03 11:34    [W:4.081 / U:0.612 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site