Improve memfd-secret guard page allocation - #18
Conversation
… page Co-authored-by: Prabhpreet Dua <615318+prabhpreet@users.noreply.github.com> Co-authored-by: Karolin Varner <karo@cupdev.net>
Improve memfd-secret guard page allocation by using combination of mmap to map allocation area, and nest memfd-secret mapping and meta information with different permissions within the area Implemented in quininer/memsec#18 Co-authored-by: Prabhpreet Dua <615318+prabhpreet@users.noreply.github.com> Co-authored-by: Karolin Varner <karo@cupdev.net>
|
|
||
| let ptr = libc::mmap( | ||
| ptr::null_mut(), | ||
| if ptr.is_some() { |
There was a problem hiding this comment.
| if ptr.is_some() { | |
| ptr.unwrap_or_else(ptr::null_mut) |
There was a problem hiding this comment.
Thank you, changed
| let total_size = front_guard_size + unprotected_size + back_guard_size; | ||
|
|
||
| let base_ptr = libc::mmap( | ||
| null_mut(), |
There was a problem hiding this comment.
| null_mut(), | |
| ptr::null_mut(), |
There was a problem hiding this comment.
Thank you, changed
| pub unsafe fn alloc_memfd_secret(size: usize) -> Option<(NonNull<u8>, libc::c_int)> { | ||
| pub unsafe fn alloc_memfd_secret( | ||
| size: usize, | ||
| ptr: Option<*mut libc::c_void>, |
There was a problem hiding this comment.
That is just for added flexibility, under cases a user directly wants to use alloc_memfd_secret and doesn't want to set a specific address for the mapping
There was a problem hiding this comment.
This is an internal function and no user will call it directly. we don't have to keep Option.
|
|
||
| #[inline] | ||
| pub unsafe fn alloc_memfd_secret(size: usize) -> Option<(NonNull<u8>, libc::c_int)> { | ||
| pub unsafe fn alloc_memfd_secret( |
There was a problem hiding this comment.
Changed to alloc_memfd_secret_at_ptr
| pub unsafe fn alloc_memfd_secret(size: usize) -> Option<(NonNull<u8>, libc::c_int)> { | ||
| pub unsafe fn alloc_memfd_secret( | ||
| size: usize, | ||
| ptr: Option<*mut libc::c_void>, |
There was a problem hiding this comment.
This is an internal function and no user will call it directly. we don't have to keep Option.
|
@quininer seems like the Github action is running forever. Is it possible to restart it? |
|
It looks like procspawn has some issue in the process spawned- I'll be able to attend to this only after next week |
2 participants
Improve memfd-secret guard page allocation by using combination of mmap to map allocation area, and nest memfd-secret mapping and meta information with different permissions within the area
Ideated by @koraa