Linus Torvalds torvalds@linux-foundation.org wrote:
On Tue, 14 May 2024 at 18:47, Theo de Raadt deraadt@openbsd.org wrote:
Linus Torvalds torvalds@linux-foundation.org wrote:
Regarding mprotect(), POSIX also says:
An implementation may permit accesses other than those specified by prot; however, no implementation shall permit a write to succeed where PROT_WRITE has not been set or shall permit any access where PROT_NONE alone has been set.Why do you quote entirely irrelevant issues?
If the mprotect didn't succeed, then clearly the above is irrelevant.
Imagine the following region:
<--------------------------------------------- len [region PROT_READ] [region PROT_READ + sealed] addr ^
then perform mprotect(addr, len, PROT_WRITE | PROT_READ);
This will return -1, with EPERM, when it encounters the sealed region.
I believe in Linux, since it has not checked for errors as a first phase, this changes the first region of memory to PROT_READ | PROT_WRITE. Liam, is that correct? If I am correct, then this follows:
So tell me -- did the mprotect() system call succeed or did not it succeed?
If EPERM means it did not succeed, then why is the first region now writable?
Immediately after this "call that failed", the process can perform a write to that first region. But no succesful system call was made to change that memory to PROT_WRITE.
Alternatively, does EPERM mean it did not completely fail, and therefore it is OK that that the prot value has been applied? That's really obscure, and undocumented.
In any case it seems, PROT_WRITE can be set on memory, and it is even more pointless than before for userland to check the errno *because you can't determine the resulting protection on every page of memory. It's all a mishmash after that.
(There is no POSIX system call to ask "what is the permission of a page or region).
Theo, you're making shit up.
I'm trying to have a technical discussion. Please change your approach, Linus.