The Linux kernel memory protection key implementation now properly preserves state in forked child processes since Linux 5.0:
github.com/torvalds/linux
This was discovered while working on a minor security feature for my hardened malloc (github.com/AndroidHardeni) leveraging MPK.
Conversation
In the thread where the patch was originally submitted, I brought up that it's difficult to handle the issue even now that it's fixed:
lore.kernel.org/patchwork/patc
It would have been nice if they'd added a no-op flag to pkey_alloc for detecting the significant change in behavior.
1
1
I implemented a workaround disabling pkey use in forked child processes (until exec), and that can now be disabled for patched kernels. However, I can't safely or efficiently detect patched kernels. I'd need to whitelist a version for each stable branch.