[PATCH v3 2/3] proc: query LSMs for introspective mem access (if PROC_MEM_FORCE_ALWAYS)
Serge E. Hallyn
serge at hallyn.com
Tue Sep 15 17:54:27 UTC 2026
On Tue, Sep 15, 2026 at 01:24:27PM -0400, Paul Moore wrote:
> On Tue, Sep 15, 2026 at 1:04 PM Serge Hallyn (AMD) <sergeh at kernel.org> wrote:
> > On Mon, Sep 07, 2026 at 11:00:17PM +0200, Jann Horn wrote:
> > > If the system is running with PROC_MEM_FORCE_ALWAYS, LSMs currently have no
> > > good opportunity to block a process from overwriting read-only code in its
> > > own address space through FOLL_FORCE writes via /proc/self/mem.
> > > The security_ptrace_access_check() LSM hook is bypassed when a process
> > > opens /proc/self/mem because this is considered "introspection".
> > >
> > > This causes a hole in SELinux EXECMEM enforcement, which tries to ensure
> > > that a process cannot create executable anonymous pages.
> > >
> > > PROC_MEM_FORCE_PTRACE prevents that and ensures that such FOLL_FORCE
> > > accesses are only possible when the LSM allows ptrace() attachment; but it
> > > is unclear how quickly PROC_MEM_FORCE_PTRACE can be deployed in
> > > environments running lots of third-party code, such as Android.
> > >
> > > So, introduce a new LSM hook that can forbid FOLL_FORCE specifically for
> > > such "introspective" accesses.
> > >
> > > Acked-by: Lorenzo Stoakes (ARM) <ljs at kernel.org>
> > > Acked-by: David Hildenbrand (Arm) <david at kernel.org>
> > > Signed-off-by: Jann Horn <jannh at google.com>
> > > ---
> > > fs/proc/base.c | 14 ++++++++++++--
> > > include/linux/lsm_hook_defs.h | 1 +
> > > include/linux/security.h | 7 +++++++
> > > security/security.c | 25 +++++++++++++++++++++++++
> > > 4 files changed, 45 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/fs/proc/base.c b/fs/proc/base.c
> > > index bec6197329dc..295b21203c7f 100644
> > > --- a/fs/proc/base.c
> > > +++ b/fs/proc/base.c
> > > @@ -851,6 +851,11 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
> > > /* private_data for proc_mem_operations */
> > > struct mem_private {
> > > struct mm_struct *mm;
> > > + /*
> > > + * Was the ptrace access check on open bypassed because the opener used
> > > + * the same MM (introspection)?
> > > + */
> > > + bool opened_by_owner;
> > > };
> > >
> > > static int mem_open(struct inode *inode, struct file *file)
> > > @@ -864,12 +869,14 @@ static int mem_open(struct inode *inode, struct file *file)
> > > priv->mm = proc_mem_open(inode, PTRACE_MODE_ATTACH);
> > > if (IS_ERR_OR_NULL(priv->mm))
> > > return priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
> > > + priv->opened_by_owner = priv->mm == current->mm;
> > > file->private_data = no_free_ptr(priv);
> > > return 0;
> > > }
> > >
> > > static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm)
> > > {
> > > + struct mem_private *priv = file->private_data;
> > > struct task_struct *task;
> > > bool ptrace_active = false;
> > >
> > > @@ -884,10 +891,13 @@ static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm)
> > > READ_ONCE(task->parent) == current;
> > > put_task_struct(task);
> > > }
> > > - return ptrace_active;
> > > + if (!ptrace_active)
> > > + return false;
> > > + break;
> > > default:
> > > - return true;
> > > + break;
> > > }
> > > + return security_mem_foll_force(file->f_cred, priv->opened_by_owner) == 0;
> > > }
> > >
> > > static ssize_t mem_rw(struct file *file, char __user *buf,
> > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> > > index 65c9609ec207..12f84a1e6fab 100644
> > > --- a/include/linux/lsm_hook_defs.h
> > > +++ b/include/linux/lsm_hook_defs.h
> > > @@ -36,6 +36,7 @@ LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from,
> > > LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child,
> > > unsigned int mode)
> > > LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent)
> > > +LSM_HOOK(int, 0, mem_foll_force, const struct cred *subject, bool opened_by_owner)
> > > LSM_HOOK(int, 0, capget, const struct task_struct *target, kernel_cap_t *effective,
> > > kernel_cap_t *inheritable, kernel_cap_t *permitted)
> > > LSM_HOOK(int, 0, capset, struct cred *new, const struct cred *old,
> > > diff --git a/include/linux/security.h b/include/linux/security.h
> > > index 153e9043058f..e8bc2e644241 100644
> > > --- a/include/linux/security.h
> > > +++ b/include/linux/security.h
> > > @@ -338,6 +338,7 @@ int security_binder_transfer_file(const struct cred *from,
> > > const struct cred *to, const struct file *file);
> > > int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
> > > int security_ptrace_traceme(struct task_struct *parent);
> > > +int security_mem_foll_force(const struct cred *subject, bool opened_by_owner);
> > > int security_capget(const struct task_struct *target,
> > > kernel_cap_t *effective,
> > > kernel_cap_t *inheritable,
> > > @@ -676,6 +677,12 @@ static inline int security_ptrace_traceme(struct task_struct *parent)
> > > return cap_ptrace_traceme(parent);
> > > }
> > >
> > > +static inline int security_mem_foll_force(const struct cred *subject,
> > > + bool opened_by_owner)
> > > +{
> > > + return 0;
> > > +}
> > > +
> > > static inline int security_capget(const struct task_struct *target,
> > > kernel_cap_t *effective,
> > > kernel_cap_t *inheritable,
> > > diff --git a/security/security.c b/security/security.c
> > > index 71aea8fdf014..2cde1efdb7a6 100644
> > > --- a/security/security.c
> > > +++ b/security/security.c
> > > @@ -595,6 +595,31 @@ int security_ptrace_traceme(struct task_struct *parent)
> > > return call_int_hook(ptrace_traceme, parent);
> > > }
> > >
> > > +/**
> > > + * security_mem_foll_force() - Check if FOLL_FORCE is allowed
> > > + * @subject: credentials using which /proc/$pid/mem was opened
> > > + * @opened_by_owner: whether checks on open() were bypassed because the opener
> > > + * has the same MM as the target
> > > + *
> > > + * Check if FOLL_FORCE is allowed for accessing process memory through
> > > + * /proc/$pid/mem. opened_by_owner signals whether the opener's MM was the same
> > > + * as the target MM, meaning the security_ptrace_access_check() hook was
> > > + * bypassed on open().
> > > + * (Current current->mm does not matter for this; for example, if write() is
> > > + * called on an FD that was received from another process which obtained it with
> > > + * open("/proc/self/mem"), @opened_by_owner is still true.)
> > > + *
> > > + * Note that this hook is only designed to be useful in the opened_by_owner
> > > + * case, where the subject credentials effectively also describe the object.
> >
> > Given this, would it make more sense to call the hook something
> > like `security_mem_foll_force_self()` and only call it in the
> > opened_by_owner==true case?
>
> Sometimes we can't avoid it, but in general I'd like to see us avoid
> calling LSM hooks conditionally, I'd much prefer the hook
> implementation (either at the LSM framework level or the individual
> LSM) do the conditional check. See my comments on the previous
> revision.
Ah. Sorry, I had missed that. +1.
More information about the Linux-security-module-archive
mailing list