Re: [PATCH v2 3/3] selinux: require PROCESS__PTRACE for FOLL_FORCE introspection

Stephen Smalley <[email protected]> Tue, 25 Aug 2026 15:30:49 -0400

Newsgroups	gmane.linux.kernel.lsm,gmane.linux.file-systems,gmane.linux.kernel.mm
Message-ID	<CAEjxPJ7ecY4msx_tGxW1bO9ywDpB0wRv3GtQyu2SnsGV9May_g@mail.gmail.com>

On Tue, Aug 25, 2026 at 2:39 PM Jann Horn <[email protected]> wrote:
>
> On systems configured with PROC_MEM_FORCE_ALWAYS, ensure that a process can
> only create anonymous executable memory via /proc/self/mem if it has
> PROCESS__PTRACE (like when using /proc/$pid/mem of another process).
>
> This closes a hole in code integrity enforcement that Project Zero has used
> in a remote Android exploit chain:
> It was possible to use a memory corruption bug in a service without
> EXECMEM/EXECMOD/PTRACE permission to overwrite executable code via
> /proc/self/mem, which made it possible to load and run shellcode containing
> a kernel exploit.
>
> Signed-off-by: Jann Horn <[email protected]>

Acked-by: Stephen Smalley <[email protected]>