diff options
| author | Mimi Zohar <zohar@linux.ibm.com> | 2020-05-03 01:00:02 -0400 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2020-05-22 14:41:04 -0400 |
| commit | 8eb613c0b8f19627ba1846dcf78bb2c85edbe8dd (patch) | |
| tree | 7cd7a2a48ae7c51b0d1db9b2aa71ede32f76812d /security/security.c | |
| parent | 0c4395fb2aa77341269ea619c5419ea48171883f (diff) | |
ima: verify mprotect change is consistent with mmap policy
Files can be mmap'ed read/write and later changed to execute to circumvent
IMA's mmap appraise policy rules. Due to locking issues (mmap semaphore
would be taken prior to i_mutex), files can not be measured or appraised at
this point. Eliminate this integrity gap, by denying the mprotect
PROT_EXECUTE change, if an mmap appraise policy rule exists.
On mprotect change success, return 0. On failure, return -EACESS.
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/security.c')
| -rw-r--r-- | security/security.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/security/security.c b/security/security.c index 7fed24b9d57e..dd0917c5bfe9 100644 --- a/security/security.c +++ b/security/security.c @@ -1512,7 +1512,12 @@ int security_mmap_addr(unsigned long addr) int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot) { - return call_int_hook(file_mprotect, 0, vma, reqprot, prot); + int ret; + + ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); + if (ret) + return ret; + return ima_file_mprotect(vma, prot); } int security_file_lock(struct file *file, unsigned int cmd) |