[PATCH v8 0/8] Add support for memory sealing

[Florian Weimer]

* Adhemerval Zanella Netto:

>> CRIU needs to be able to unmap everything that was initially loaded by
>> the kernel and glibc.  This will stop working if we use mseal for glibc
>> itself.
>
> So in this case the easiest way it to filter of mseal (with seccomp or
> something related) and disable sealing.  I don't have a easy solution.

Please test with CRIU and trace and find a way to make them work again
if they are broken.

>>> A dynamic tag would add support only for ET_DYN, where a GNU attribute
>>> allows for ET_EXEC as well (similar to recent hardening mechanism like
>>> BTI, GCS, etc.).
>> 
>> We don't need the compatibility indicator on static executables because
>> incompatible static binaries won't have the PT_* header that requests
>> sealing.
>
> But we will still need to mark the ET_EXEC as opt-in for sealing.  A dynamic
> tag will be only enabled for ET_DYN.

If the PT_* address ranges are present, the binary opts in to sealing.

> Is this allocated dynamic during process execution of defined during build?
> Can't you put this on relro segment, with a constructor to do any required
> initialization?

Constructors currently run after RELRO has been applied.

Thanks,
Florian