[PATCH v2 3/3] selinux: require PROCESS__PTRACE for FOLL_FORCE introspection

[Stephen Smalley]

On Tue, Aug 25, 2026 at 2:39 PM Jann Horn <jannh at google.com> wrote:
>
> On systems configured with PROC_MEM_FORCE_ALWAYS, ensure that a process can
> only create anonymous executable memory via /proc/self/mem if it has
> PROCESS__PTRACE (like when using /proc/$pid/mem of another process).
>
> This closes a hole in code integrity enforcement that Project Zero has used
> in a remote Android exploit chain:
> It was possible to use a memory corruption bug in a service without
> EXECMEM/EXECMOD/PTRACE permission to overwrite executable code via
> /proc/self/mem, which made it possible to load and run shellcode containing
> a kernel exploit.
>
> Signed-off-by: Jann Horn <jannh at google.com>

Acked-by: Stephen Smalley <stephen.smalley.work at gmail.com>