This merge request brings in several patches needed to add support for a memfd_create() syscall into kernel version 3.4 from kernel version 3.17 (!). This is required for running lxc >= 3.1.0-r1 with security patch that fixes CVE-2019-5736.
In short, security issue was that in a privileged container root process could overwrite lxc-start executable by opening its file descriptor and rewriting executable contents. This is where memfd comes to help: you can create an in-memory file, copy your executable there, and place a set of SEALS to protect it from modifying at a deep level. Then you fexecve() that fd and you're safe.
This elminates the need for me to keep a forked lxc package that is built without mentioned CVE-2019-5736 fix, thus not requiring memfd_create() syscall.
This backports the following commits:
0009-Backport-cache-the-value-of-file_inode-in-struct-file - commit from 3.10 to have an f_inode member inside struct file and a helper function file_inode() that is used in some of the following commits
0010-Backport-shm-add-sealing-API - that miraculous SEALS you can put on memfd file
0012-Backport-asm-generic-add-memfd_create-system-call-to-unistd.h and 0013-Backport-ARM-wire-up-memfd_create-syscall are needed to make the syscall visible/usable from userspace, one in generic context, other for ARM arch.
klte:~/dev/test_memfd/build$ ./test_memfd_exec Hello, World!Function not implemented - Failed to rexec as memfdFailed to re-execute liblxc via memory file descriptor
Now it succeds:
Later I've confirmed that original upstream unmodified lxc runs my android in container without issues.
Oh, and also this MR moves kernel base commit to a newer one in lineageOS 14.1 branch. It got ~10 commits with various backports/fixes, too (see the commits on Jun 19, 2019).
