Linux has a new(ish) syscall you should know about.
mseal ("memory sealing") locks memory regions against modification. Many shellcode techniques are blocked since executable permissions can’t be added to sealed memory.
Here’s how it works:
mseal ("memory sealing") locks memory regions against modification. Many shellcode techniques are blocked since executable permissions can’t be added to sealed memory.
Here’s how it works:
mseal adds a VM_SEALED flag to memory regions, stopping attackers from using syscalls like mprotect and munmap to alter permissions or remap memory.
This hardens against common exploits by ensuring protected memory stays intact during runtime.
This hardens against common exploits by ensuring protected memory stays intact during runtime.
The syscall proved...controversial.
(read the linux mailing list on the subject, it's a doozy)
Linus criticized mseal's implementation as “nonsensical” for its inconsistent application of sealing rules across memory operations. Thankfully, they eventually came to a consensus.
(read the linux mailing list on the subject, it's a doozy)
Linus criticized mseal's implementation as “nonsensical” for its inconsistent application of sealing rules across memory operations. Thankfully, they eventually came to a consensus.
mseal is now available in kernel 6.10+
To use it, apps need to seal sensitive memory regions via direct syscall invocation.
It's not an automatic process, but it's an interesting new tool that I hope to see more of, especially in highly targeted applications like web browsers
To use it, apps need to seal sensitive memory regions via direct syscall invocation.
It's not an automatic process, but it's an interesting new tool that I hope to see more of, especially in highly targeted applications like web browsers
• • •
Missing some Tweet in this thread? You can try to
force a refresh
