CHERI Linux currently lacks mmap() protection flags to control whether capabilities may be written to or read from the mapped pages. CheriBSD has the protection flags PROT_CAP and PROT_NO_CAP for this. They are documented in CheriBSD's mmap() man page, including when each is implied automatically: https://man.cheribsd.org/cgi-bin/man.cgi/release-25.03/mmap.2
It would also be useful for CHERI Linux to add the signal codes SEGV_LOADTAG and SEGV_STORETAG, which indicate faults that occur when a loading or storing a capability fails due to insufficient page permissions.
@chrehrhardt had at least one case in the past that required user space modifications because these flags were missing.
CHERI Linux currently lacks mmap() protection flags to control whether capabilities may be written to or read from the mapped pages. CheriBSD has the protection flags PROT_CAP and PROT_NO_CAP for this. They are documented in CheriBSD's mmap() man page, including when each is implied automatically: https://man.cheribsd.org/cgi-bin/man.cgi/release-25.03/mmap.2
It would also be useful for CHERI Linux to add the signal codes SEGV_LOADTAG and SEGV_STORETAG, which indicate faults that occur when a loading or storing a capability fails due to insufficient page permissions.
@chrehrhardt had at least one case in the past that required user space modifications because these flags were missing.