[RFC 0/1] elf: mseal non-writable segments

[Stephen Roettger <sroettger@google.com>]

Hi all,

I'm trying to implement mseal support in the runtime loader and would
like to get some feedback on the approach.

Mseal is an upcoming syscall in Linux [0] similar to OpenBSD's
mimmutable. In short, it prevents changes to sealed mappings during the
process lifetime, for example unmapping or permission changes.

I would like to add support to the runtime loader to automatically seal
mappings if possible, in particular code and read-only data. I wrote a
simple prototype and did some basic testing on a non-graphical debian.
It currently seals any PT_LOAD segments if:
* the writable bit is not set
* the mode is RTLD_NODELETE
(TODO: I need to add support for GNU_RELRO)

And in addition, I added RTLD_NODELETE in a few places so that more
objects get sealed:
* when loading the main binary and libraries
* I added propagation for RTLD_NODELETE for any auxiliary libraries

In my basic testing, this seems to work fine. But a few questions that
I'd like some feedback on:
* Does it sound ok to apply sealing by default? Should this be a flag in
  the ELF, e.g. maybe the p_flags could have a sealable bit?
* Does it make sense to piggyback on the RTLD_NODELETE bit and apply it
  to more objects? It seems to have the right semantics: the object
  should never get deleted => it's ok to seal the mappings.

[0] https://lore.kernel.org/lkml/20240415163527.626541-1-jeffxu@chromium.org/

Thanks!
Stephen

Stephen Roettger (1):
  elf: mseal non-writable segments

 elf/dl-load.c         |  6 ++++++
 elf/dl-load.h         |  1 +
 elf/dl-map-segments.h |  6 ++++++
 elf/dl-open.c         |  3 ++-
 elf/rtld.c            | 12 +++++++++---
 5 files changed, 24 insertions(+), 4 deletions(-)

-- 
2.45.1.288.g0e0cd299f1-goog