man/man2/memfd_secret.2: Update default state
PATCH 1/1 man/man2/memfd_secret.2: Update default state
In commit b758fe6df50 ("mm/secretmem: make it on by default"), memfd_secret was updated to be enabled by default.
--- man/man2/memfd_secret.2 | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
man/man2/memfd_secret.2 +7 -4
@@ -182,12 +182,15 @@ or spawn a new privileged user-space process to perform secrets exfiltration using .BR ptrace (2). .P -The way +Before Linux 6.5, +.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2 +there was some concern that .BR memfd_secret () -allocates and locks the memory may impact overall system performance, -therefore the system call is disabled by default and only available +allocations and memory locking had an impact on system performance, +therefore the system call was disabled by default and only available if the system administrator turned it on using -"secretmem.enable=y" kernel parameter. +"secretmem.enable=y" kernel parameter. Since Linux 6.5, the system +call is enabled by default. .P To prevent potential data leaks of memory regions backed by .BR memfd_secret ()
Signature · 1 line
2.49.0.805.g082f7c87e0-goog
Alejandro Colomar
maintainerHi Thiébaud,
Quoted 4 lines · Thiébaud Weksteen
In commit
b758fe6df50("mm/secretmem: make it on by default"),memfd_secretwas updated to be enabled by default.Signed-off-by Thiébaud Weksteen <[email protected]>
Thanks for the patch! See some comments below.
Quoted 14 lines
--- man/man2/memfd_secret.2 | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)man/man2/memfd_secret.2 +1
-1@@ -182,12 +182,15 @@ or spawn a new privileged user-space process to perform secrets exfiltration using .BR ptrace (2). .P -The way +Before Linux 6.5,
man/man2/memfd_secret.2 or spawn a new privileged user-space process to perform · line 192
Quoted 10 lines
man/man2/memfd_secret.2 +5
-3+.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2 +there was some concern that .BR memfd_secret () -allocates and locks the memory may impact overall system performance, -therefore the system call is disabled by default and only available +allocations and memory locking had an impact on system performance, +therefore the system call was disabled by default and only available if the system administrator turned it on using -"secretmem.enable=y" kernel parameter. +"secretmem.enable=y" kernel parameter. Since Linux 6.5, the system
Please use semantic newlines. See man-pageS(7):
$ MANWIDTH=72 man man-pages | sed -n '/Use semantic newlines/,/^$/p'
Use semantic newlines
In the source of a manual page, new sentences should be started
on new lines, long sentences should be split into lines at
clause breaks (commas, semicolons, colons, and so on), and long
clauses should be split at phrase boundaries. This convention,
sometimes known as "semantic newlines", makes it easier to see
the effect of patches, which often operate at the level of indi‐
vidual sentences, clauses, or phrases.man/man2/memfd_secret.2 or spawn a new privileged user-space process to perform · line 193
Quoted 1 line
man/man2/memfd_secret.2 +1
-0+call is enabled by default.
Does this mean that there's no concerns about performance anymore? Or that security reasons are more important than performance?
I would move the entire paragraph to the HISTORY section.
Have a lovely day!
Alex
Quoted 6 lines
man/man2/memfd_secret.2 +0
-0.P To prevent potential data leaks of memory regions backed by .BR memfd_secret ()Signature · 1 line
2.49.0.805.g082f7c87e0-goog
Signature · 1 line
<https://www.alejandro-colomar.es/>
Quoted 10 lines · Alejandro Colomar
Hi Thiébaud,
Quoted 4 lines · Thiébaud Weksteen
In commit
b758fe6df50("mm/secretmem: make it on by default"),memfd_secretwas updated to be enabled by default.Signed-off-by Thiébaud Weksteen <[email protected]>Thanks for the patch! See some comments below.
Thanks for the review!
Quoted 38 lines
Quoted 15 lines
--- man/man2/memfd_secret.2 | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)man/man2/memfd_secret.2 +1
-1@@ -182,12 +182,15 @@ or spawn a new privileged user-space process to perform secrets exfiltration using .BR ptrace (2). .P -The way +Before Linux 6.5,man/man2/memfd_secret.2 or spawn a new privileged user-space process to perform · line 192
Quoted 10 lines
man/man2/memfd_secret.2 +5
-3+.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2 +there was some concern that .BR memfd_secret () -allocates and locks the memory may impact overall system performance, -therefore the system call is disabled by default and only available +allocations and memory locking had an impact on system performance, +therefore the system call was disabled by default and only available if the system administrator turned it on using -"secretmem.enable=y" kernel parameter. +"secretmem.enable=y" kernel parameter. Since Linux 6.5, the systemPlease use semantic newlines. See man-pageS(7):
$ MANWIDTH=72 man man-pages | sed -n '/Use semantic newlines/,/^$/p' Use semantic newlines In the source of a manual page, new sentences should be started on new lines, long sentences should be split into lines at clause breaks (commas, semicolons, colons, and so on), and long clauses should be split at phrase boundaries. This convention, sometimes known as "semantic newlines", makes it easier to see the effect of patches, which often operate at the level of indi‐ vidual sentences, clauses, or phrases.
Quoted 5 lines
man/man2/memfd_secret.2 or spawn a new privileged user-space process to perform · line 193
Quoted 1 line
man/man2/memfd_secret.2 +1
-0+call is enabled by default.Does this mean that there's no concerns about performance anymore? Or that security reasons are more important than performance?
From my understanding, the former. I'll send an update to remove that part (as this is not relevant anymore).
Quoted 15 lines
I would move the entire paragraph to the HISTORY section.
Have a lovely day!
AlexQuoted 6 lines
man/man2/memfd_secret.2 +0
-1.P To prevent potential data leaks of memory regions backed by .BR memfd_secret () --2.49.0.805.g082f7c87e0-goog