Re: [PATCH 2/3] proc: query LSMs for introspective mem access (if PROC_MEM_FORCE_ALWAYS)

On 8/20/26 20:44, Jann Horn wrote:
> On Thu, Aug 20, 2026 at 7:22 PM David Hildenbrand (Arm)
> <[email protected]> wrote:
>> On 8/18/26 21:51, Jann Horn wrote:
>>> If the system is running with PROC_MEM_FORCE_ALWAYS, LSMs currently have no
>>> good opportunity to block a process from overwriting read-only code in its
>>> own address space through FOLL_FORCE writes via /proc/self/mem.
>>> The security_ptrace_access_check() LSM hook is bypassed when a process
>>> opens /proc/self/mem because this is considered "introspection".
>>>
>>> This causes a hole in SELinux EXECMEM enforcement, which tries to ensure
>>> that a process cannot create executable anonymous pages.
>>>
>>> PROC_MEM_FORCE_PTRACE prevents that and ensures that such FOLL_FORCE
>>> accesses are only possible when the LSM allows ptrace() attachment; but it
>>> is unclear how quickly PROC_MEM_FORCE_PTRACE can be deployed in
>>> environments running lots of third-party code, such as Android.
>>>
>>> So, introduce a new LSM hook that can forbid FOLL_FORCE specifically for
>>> such "introspective" accesses.
>>>
>>> Signed-off-by: Jann Horn <[email protected]>
>>> ---
>>>  fs/proc/base.c                |  6 ++++++
>>>  include/linux/lsm_hook_defs.h |  1 +
>>>  include/linux/security.h      |  6 ++++++
>>>  security/security.c           | 15 +++++++++++++++
>>>  4 files changed, 28 insertions(+)
>>>
>>> diff --git a/fs/proc/base.c b/fs/proc/base.c
>>> index bec6197329dc..3dfaef49bb70 100644
>>> --- a/fs/proc/base.c
>>> +++ b/fs/proc/base.c
>>> @@ -851,6 +851,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
>>>  /* private_data for proc_mem_operations */
>>>  struct mem_private {
>>>       struct mm_struct *mm;
>>> +     /* Was the ptrace access check bypassed due to introspection? */
>>> +     bool introspection;
>>>  };
>>>
>>>  static int mem_open(struct inode *inode, struct file *file)
>>> @@ -864,12 +866,14 @@ static int mem_open(struct inode *inode, struct file *file)
>>>       priv->mm = proc_mem_open(inode, PTRACE_MODE_ATTACH);
>>>       if (IS_ERR_OR_NULL(priv->mm))
>>>               return priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
>>> +     priv->introspection = priv->mm == current->mm;
>>
>> Is the feat that the fd could be passed to someone else that would then not be
>> detected as introspection?
> 
> Yes, exactly, that's the primary reason why I did it this way.

Okay, would "opened_by_owner" or something like that be clearer? At least
"introspection" is less intuitive for me.

-- 
Cheers,

David