Is your feature request related to a problem? Please describe.
memfd_create() together with mmap() can be used to generate arbitrary executable memory contents, circumventing MemoryDenyWriteExecute=yes.
Describe the solution you'd like
MemoryDenyWriteExecute=yes should install a seccomp filter for memfd_create(). This could be a problem for compatibility.
Describe alternatives you've considered
-
Administrators could install a seccomp filter for memfd_create with SystemCallFilter directive, so no changes would be needed.
However, systemd-analyze security could educate them about the need of such filter. Supplied systemd service unit files should also include the filter when possible.
-
Compatibility could be kept while still using MemoryDenyWriteExecute for blocking memfd_create(), with a new non-boolean setting to it, like MemoryDenyWriteExecute=strict.
Is your feature request related to a problem? Please describe.
memfd_create()together withmmap()can be used to generate arbitrary executable memory contents, circumventingMemoryDenyWriteExecute=yes.Describe the solution you'd like
MemoryDenyWriteExecute=yesshould install a seccomp filter formemfd_create(). This could be a problem for compatibility.Describe alternatives you've considered
Administrators could install a seccomp filter for
memfd_createwithSystemCallFilterdirective, so no changes would be needed.However,
systemd-analyze securitycould educate them about the need of such filter. Supplied systemd service unit files should also include the filter when possible.Compatibility could be kept while still using
MemoryDenyWriteExecutefor blockingmemfd_create(), with a new non-boolean setting to it, likeMemoryDenyWriteExecute=strict.