Commit 22f6b4d3 authored by Jann Horn's avatar Jann Horn Committed by Linus Torvalds
Browse files

aio: mark AIO pseudo-fs noexec

This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set.  Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
        return 0;

In the output, "rw-s" is good, "rwxs" is bad.
Signed-off-by: default avatarJann Horn <>
Signed-off-by: default avatarLinus Torvalds <>
parent 024c7e37
......@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
static const struct dentry_operations ops = {
.d_dname = simple_dname,
return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
if (!IS_ERR(root))
root->d_sb->s_iflags |= SB_I_NOEXEC;
return root;
/* aio_setup
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment