[PATCH v8 0/8] Add support for memory sealing

[Andrei Vagin]

On Mon, Feb 03, 2025 at 11:11:56PM -0300, Cristian Rodríguez wrote:
> On Mon, Feb 3, 2025 at 4:40 PM Florian Weimer <fweimer@redhat.com> wrote:
> >
> > * Adhemerval Zanella Netto:
> >
> > >> CRIU needs to be able to unmap everything that was initially loaded by
> > >> the kernel and glibc.  This will stop working if we use mseal for glibc
> > >> itself.
> > >
> > > So in this case the easiest way it to filter of mseal (with seccomp or
> > > something related) and disable sealing.  I don't have a easy solution.
> >
> > Please test with CRIU and trace and find a way to make them work again
> > if they are broken.
> 
> that is a kernel problem afaik..

Could you please provide more details on why you think that is the
kernel issue?

btw: this reminds me another discussion about mseal on lkml:
https://lore.kernel.org/lkml/htdv44tqzi4jl2b7dwutsdwnh4tgrxq6xdvumi5wwu3hnh7sgw@tfwlal74ukx6/

> .why libc has to care about this limitation ?

CRIU has worked with glibc for many years... It's not just about CRIU;
other projects, such as gVisor and UML, are also likely to be affected.

Thanks,
Andrei