Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1685382

Re: [RFC v5 12/38] mm: ability to disable execute permission on a key at creation

Show all headers | View raw

On Wed, Jul 12, 2017 at 08:08:56AM +1000, Benjamin Herrenschmidt wrote:
> On Tue, 2017-07-11 at 14:51 -0700, Ram Pai wrote:
> > On Wed, Jul 12, 2017 at 07:29:37AM +1000, Benjamin Herrenschmidt wrote:
> > > On Tue, 2017-07-11 at 11:11 -0700, Dave Hansen wrote:
> > > > On 07/05/2017 02:21 PM, Ram Pai wrote:
> > > > > Currently sys_pkey_create() provides the ability to disable read
> > > > > and write permission on the key, at  creation. powerpc  has  the
> > > > > hardware support to disable execute on a pkey as well.This patch
> > > > > enhances the interface to let disable execute  at  key  creation
> > > > > time. x86 does  not  allow  this.  Hence the next patch will add
> > > > > ability  in  x86  to  return  error  if  PKEY_DISABLE_EXECUTE is
> > > > > specified.
> > > 
> > > That leads to the question... How do you tell userspace.
> > > 
> > > (apologies if I missed that in an existing patch in the series)
> > > 
> > > How do we inform userspace of the key capabilities ? There are at least
> > > two things userspace may want to know already:
> > > 
> > >  - What protection bits are supported for a key
> > 
> > the userspace is the one which allocates the keys and enables/disables the
> > protection bits on the key. the kernel is just a facilitator. Now if the
> > use space wants to know the current permissions on a given key, it can
> > just read the AMR/PKRU register on powerpc/intel respectively.
> 
> You misunderstand. How does userspace knows on a given system whether
> execute permission control is supported for keys ?

Ah..sorry. did not catch that part.

Yes the current patch set does not make that information available. The
indirect way of find this out is, to try to allocate a key with
execute-disable permission and decide based on the pass/fail status.

we can expose that information through a procfs/sysfs interface.

RP

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[RFC v5 12/38] mm: ability to disable execute permission on a key at creation Ram Pai <linuxram@us.ibm.com> - 2017-07-05 23:30 +0200
  Re: [RFC v5 12/38] mm: ability to disable execute permission on a key  at creation Dave Hansen <dave.hansen@intel.com> - 2017-07-11 20:20 +0200
    Re: [RFC v5 12/38] mm: ability to disable execute permission on a  key at creation Benjamin Herrenschmidt <benh@kernel.crashing.org> - 2017-07-11 23:40 +0200
      Re: [RFC v5 12/38] mm: ability to disable execute permission on a key  at creation Dave Hansen <dave.hansen@intel.com> - 2017-07-12 00:00 +0200
        Re: [RFC v5 12/38] mm: ability to disable execute permission on a  key at creation Ram Pai <linuxram@us.ibm.com> - 2017-07-12 00:20 +0200
          Re: [RFC v5 12/38] mm: ability to disable execute permission on a key  at creation Dave Hansen <dave.hansen@intel.com> - 2017-07-12 00:30 +0200
      Re: [RFC v5 12/38] mm: ability to disable execute permission on a  key at creation Ram Pai <linuxram@us.ibm.com> - 2017-07-12 00:00 +0200
        Re: [RFC v5 12/38] mm: ability to disable execute permission on a  key at creation Benjamin Herrenschmidt <benh@kernel.crashing.org> - 2017-07-12 00:10 +0200
          Re: [RFC v5 12/38] mm: ability to disable execute permission on a  key at creation Ram Pai <linuxram@us.ibm.com> - 2017-07-12 00:30 +0200

csiph-web