3 ms·

I'm a little confused, can't you already clear the page's write flag with mprotect? i feel like I must missing some important detail because iiuc mseal doesn't

• winternewt 2y ago
  The detail is that mprotect also lets you add the writable flag back. With mseal the kernel will refuse future changes to the protection flags.
• superb_dev 2y ago
  I believe the difference is that ‘mseal’ goes further than preventing any writes to memory, it also prevents the address space itself from changing. For example: if some file had been ‘mmap’ed in before the call to ‘mseal’, it can’t then be unmapped
  • fweimer 2y ago
    It does not prevent all writes, it only prevents protection flag changes, mapping over the region, and unmapping. As far as I understand it, sealed memory might even be writable. If the sealed memory is read-only, debuggers and other tools can still patch mseal'ed memory regions using ptrace and similar interfaces.
• saagarjha 2y ago
  mseal prevents you from doing that in reverse.