[PATCH v6 0/9] Add support for memory sealing

[Jeff Xu]

Hi Florian,

On Mon, Oct 13, 2025 at 1:17 AM Florian Weimer <fweimer@redhat.com> wrote:
>
> * Jeff Xu:
>
> > There are two solutions for such a case in the future:
> > 1. Do not turn on sealing when building the main binary.
> > 2. Use the .gnu.mutable solution to mark specific areas/variables to
> > be not sealable.
>
> (1) does not work if we are dealing with code that is usually loaded
> through dlopen (such as userspace graphics drivers and Python modules).
>
In order for dlopen() to seal the mapping, three conditions must be met:
1. the dll has GNU_PROPERTY_MEMORYSEAL flag set
2. dlopen() uses the RTLD_NODELETE flag.
3.The main binary has sealing enabled (e.g. GNU_PROPERTY_MEMORYSEAL is set)

Either the dll or the main binary can disable the sealing at build time.

There will be a long tail of such "runtime patching" cases to be
discovered when apps start enabling sealing. V6 already considered
those cases without causing regression.

Thanks
-Jeff