file-sealing · shipping · also file seals, memfd sealing

Linux file sealing

Linux file sealing irreversibly restricts selected operations on a supported file, with restrictions shared by all descriptors referring to its inode.

Related Observatory article: Linux file sealing on hesela.com

Scope: F_ADD_SEALS adds restrictions and F_GET_SEALS reads them. F_SEAL_SEAL prevents further additions, rather than freezing content. Restrictions cannot be removed. [1]

Writes: F_SEAL_WRITE cannot be installed while a shared writable mapping exists. F_SEAL_FUTURE_WRITE allows earlier shared writable mappings to keep changing the file while blocking new ones and write calls. A pre-existing shared PROT_READ mapping from a writable descriptor can also block F_SEAL_WRITE: Linux counts potential write capability, not only current store permissions. [4] Private copy-on-write mappings remain distinct from writes to the backing object. [1] [3]

Size: F_SEAL_SHRINK and F_SEAL_GROW control resizing separately from writes. Combining both with F_SEAL_WRITE constrains size and content through these APIs. Seals on volatile memfds do not create persistent storage or authenticate the data's origin. [2]

Mapping order: changing an earlier shared mapping to PROT_READ does not necessarily remove its potential write capability. In the companion Linux 6.8 controls, it could be upgraded after FUTURE_WRITE and modify the file. A shared read-only mapping created after that seal could not be upgraded; the kernel clears VM_MAYWRITE at mapping creation. [3] [5]

Read-only descriptors: a shared mapping from a separately reopened O_RDONLY descriptor could not be upgraded, but still saw writes through another descriptor before sealing. That reader did not prevent the writable descriptor from installing WRITE. Adding seals itself requires a writable descriptor. [1] [5]

Relations

related

memfd-create, memory-mapped-file, file-truncation, copy-on-write

Advantages

• Kernel enforcement can constrain a peer that holds a writable descriptor.

Limitations

• A receiver still needs to inspect the actual seal mask and validate the application's data format.

Citations

1. Linux man-pages: F_GET_SEALS / F_ADD_SEALS (accessed 2026-10-17)
2. Linux v6.12: memfd sealing implementation (accessed 2026-10-17)
3. Linux v6.12: seal_check_write mapping checks (accessed 2026-10-17)
4. Linux v6.12: shared mappings with potential write capability (accessed 2026-10-18)
5. Linux man-pages: mprotect(2), access changes and EACCES (accessed 2026-10-18)

JSON: /data/terms/file-sealing.json