Google Proposes New Mseal() Memory Sealing Syscall for Linux

This is the best summary I could come up with:

Google is proposing a new mseal() memory sealing system call for the Linux kernel.

Google intends for this architecture independent system call to be initially used by the Google Chrome web browser on Chrome OS while experiments are underway for use by Glibc in the dynamic linker to seal all non-writable segments at startup.

Leveraging mseal() will prevent system calls from modifying the metadata of virtual addresses.

Initially supported is sealing against mprotect/pkey_mprotect, munmap, mmap, and mremap calls.

Making the virtual memory area's metadata immutable is being sought for better protections within Google Chrome and the V8 JavaScript engine.

But it's not going to be accepted straight-away and will likely take some revisions before evolving into a suitable form for upstreaming... Linus Torvalds himself has already expressed some reservations around the proposed model: So I have no objections to adding some kind of "lock down memory mappings" model, but this isn't it.

The original article contains 328 words, the summary contains 152 words. Saved 54%. I'm a bot and I'm open source!