ANDROID: GKI: enable CONFIG_MSEAL_SYSTEM_MAPPINGS
Enable memory sealing for system mappings such as
vdso, vvar, vvar_vclock, vectors (arm compat-mode),
sigpage (arm compat-mode), uprobes.
Those system mappings are readonly only or execute
only, memory sealing can protect them from ever
changing to writable or unmmap/remapped as different
attributes. This is useful to mitigate memory corruption
issues where a corrupted pointer is passed to a memory
management system.
This feature breaks programs which rely on relocating
of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr.
Those features/programes are not used in Android, therefore
it is OK to enable.
The feature requires CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS,
linux main already set it for x86-64 and arm64 architectures.
The feature is available since 6.15.rc1, and this patch enable it
for android main branch.
Bug: 443759875
Change-Id: I42458f4a734f4b107d0e1b06317f9b7b5f5ef1ae
Signed-off-by:
Jeff Xu <jeffxu@google.com>
Loading
Please sign in to comment