Skip to content

package: fix memfd_create warnings on Linux kernels < 6.7

Petr Štetiar requested to merge ynezz/apk-tools:ynezz/memfd_create into master

Linux kernel in version 6.3 and commit 105ff5339f49 ("mm/memfd: add MFD_NOEXEC_SEAL and MFD_EXEC") introduced following new flags:

  The new MFD_NOEXEC_SEAL and MFD_EXEC flags allows application to set
  executable bit at creation time (memfd_create).

  When MFD_NOEXEC_SEAL is set, memfd is created without executable bit
  (mode:0666), and sealed with F_SEAL_EXEC, so it can't be chmod to be
  executable (mode: 0777) after creation.

  when MFD_EXEC flag is set, memfd is created with executable bit
  (mode:0777), this is the same as the old behavior of memfd_create.

Additionally if neither of those flags is set, kernel provides following warning:

  apk[3504]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set

That warning was removed later in version 6.7 and commit 1717449b4417 ("memfd: drop warning for missing exec-related flags"):

  Commit 434ed3350f57 ("memfd: improve userspace warnings for missing
  exec-related flags") attempted to make these warnings more useful (so
  they would work as an incentive to get users to switch to specifying
  these flags -- as intended by the original MFD_NOEXEC_SEAL patchset).

  ... snip ...

  Given that the flags are new and there is no harm to not specifying them
  (after all, we maintain backwards compatibility) we can just drop the
  warnings for now until some time in the future when most programs have
  migrated and distributions start using vm.memfd_noexec=1 (where failing
  to pass the flag would result in unexpected errors for programs that use
  executable memfds).

So lets silence the warning on affected kernels and make apk future proof by setting the desired MFD_EXEC flag.

Fixes: a92ae2d5 ("package: use memfd for scripts when available")

Edited by Petr Štetiar

Merge request reports

Loading