Messages in this thread | | | Subject | Re: [PATCH v38 10/24] mm: Add vm_ops->mprotect() | From | Dave Hansen <> | Date | Thu, 24 Sep 2020 16:09:25 -0700 |
| |
On 9/24/20 4:05 PM, Sean Christopherson wrote: > The problem is that enforcing permissions via mprotect() needs to be done > unconditionally, otherwise we end up with weird behavior where the existence > of an LSM will change what is/isn't allowed, even if the LSM(s) has no SGX > policy whatsover.
Could we make this a bit less abstract, please?
Could someone point to code or another examples that demonstrates how the mere existence of an LSM will change what is/isn't allowed?
I can't seem to wrap my head around it as-is.
| |