Date: Thu, 24 Apr 2025 12:26:05 +1000
Precedence: bulk
Mime-Version: 1.0
Message-ID: <20250424022605.10485-1-tweek@google.com>
Subject: [PATCH] man/man2/memfd_secret.2: Update default state
From: "=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" <tweek@google.com>
To: Alejandro Colomar <alx@kernel.org>
Cc: linux-man@vger.kernel.org, Mike Rapoport <rppt@kernel.org>, 
	"=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" <tweek@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

In commit b758fe6df50 ("mm/secretmem: make it on by default"),
memfd_secret was updated to be enabled by default.

Signed-off-by: Thi=C3=A9baud Weksteen <tweek@google.com>
---
 man/man2/memfd_secret.2 | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
index 322d67a41..2eb6db599 100644
--- a/man/man2/memfd_secret.2
+++ b/man/man2/memfd_secret.2
@@ -182,12 +182,15 @@ or spawn a new privileged user-space process to perfo=
rm
 secrets exfiltration using
 .BR ptrace (2).
 .P
-The way
+Before Linux 6.5,
+.\" commit b758fe6df50daf68fef089d8f3c1cd49fc794ed2
+there was some concern that
 .BR memfd_secret ()
-allocates and locks the memory may impact overall system performance,
-therefore the system call is disabled by default and only available
+allocations and memory locking had an impact on system performance,
+therefore the system call was disabled by default and only available
 if the system administrator turned it on using
-"secretmem.enable=3Dy" kernel parameter.
+"secretmem.enable=3Dy" kernel parameter. Since Linux 6.5, the system
+call is enabled by default.
 .P
 To prevent potential data leaks of memory regions backed by
 .BR memfd_secret ()
--=20
2.49.0.805.g082f7c87e0-goog