Merge patch series "proc,security,selinux: let SELinux block FOLL_FORCE for /proc/self/mem"

Jann Horn <jannh@google.com> says:

The goal of this series is to let SELinux prevent the use of FOLL_FORCE
when a process writes into /proc/self/mem and the system is configured
with PROC_MEM_FORCE_ALWAYS (which used to be the default behavior, and
is still used by current Android devices).

Android has SELinux policy that attempts to ensure that only trusted
code can be mapped as executable in several system processes, but this
protection can currently be bypassed by writing into /proc/self/mem.

I wrote this series after discussion with Android security folks about
the state of proc_mem_foll_force() restrictions on Android.

The motivation for this series is that Project Zero managed to write a
remote exploit for Google Pixel partly because of /proc/self/mem, see
<https://projectzero.google/2026/01/pixel-0-click-part-1.html#whats-the-plan-seth-and-jann>.

* patches from https://patch.msgid.link/20260907-selinux-pokemem-v3-0-0bafbaeafe50@google.com:
  selinux: require PROCESS__PTRACE for FOLL_FORCE introspection
  proc: query LSMs for introspective mem access (if PROC_MEM_FORCE_ALWAYS)
  proc: refactor /proc/$pid/mem to use struct as private_data

Link: https://patch.msgid.link/20260907-selinux-pokemem-v3-0-0bafbaeafe50@google.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions