lkml.org 
[lkml]   [2020]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC PATCH v1] ima: verify mprotect change is consistent with mmap policy
From
Date
On 5/5/20 10:30 AM, Mimi Zohar wrote:

> Files can be mmap'ed read/write and later changed to execute to circumvent
> IMA's mmap appraise policy rules. Due to locking issues (mmap semaphore
> would be taken prior to i_mutex), files can not be measured or appraised at
> this point. Eliminate this integrity gap, by denying the mprotect
> PROT_EXECUTE change, if an mmap appraise policy rule exists.
>
> On mprotect change success, return 0. On failure, return -EACESS.
>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> Changelog v1:
> - Reverse tests to remove code indentation. (Lakshmi Ramasubramanian)
> - General code cleanup, including adding comments.
>
> include/linux/ima.h | 7 ++++++
> security/integrity/ima/ima_main.c | 51 +++++++++++++++++++++++++++++++++++++++
> security/security.c | 7 +++++-
> 3 files changed, 64 insertions(+), 1 deletion(-)

Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>

\
 
 \ /
  Last update: 2020-05-05 19:52    [W:0.055 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site