ima: verify mprotect change is consistent with mmap policy

Files can be mmap'ed read/write and later changed to execute to circumvent IMA's mmap appraise policy rules. Due to locking issues (mmap semaphore would be taken prior to i_mutex), files can not be measured or appraised at this point. Eliminate this integrity gap, by denying the mprotect PROT_EXECUTE change, if an mmap appraise policy rule exists. On mprotect change success, return 0. On failure, return -EACESS.

Mimi Zohar committed 6 years ago

Commit 8eb613c1 parent 0c4395f3 files · +64 −1Browse files

Showing the changes to include/linux (1 of 3 files). Show all

Unified · Split

include/linux/ima.h+7−0

@@ -18,6 +18,7 @@ extern int ima_file_check(struct file *file, int mask); · 17 unmodified lines
18	18	extern void ima_post_create_tmpfile(struct inode *inode);
19	19	extern void ima_file_free(struct file *file);
20	20	extern int ima_file_mmap(struct file *file, unsigned long prot);
	21	+extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
21	22	extern int ima_load_data(enum kernel_load_data_id id);
22	23	extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
23	24	extern int ima_post_read_file(struct file file, void buf, loff_t size,
@@ -70,6 +71,12 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot) · 46 unmodified lines
70	71	return 0;
71	72	}
72	73
	74	+static inline int ima_file_mprotect(struct vm_area_struct *vma,
	75	+ unsigned long prot)
	76	+{
	77	+ return 0;
	78	+}
	79	+
73	80	static inline int ima_load_data(enum kernel_load_data_id id)
74	81	{
75	82	return 0;