| Message ID | 20231107134012.682009-3-roberto.sassu@huaweicloud.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | security: Move IMA and EVM to the LSM infrastructure | expand |
On 11/7/2023 5:39 AM, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > Change ima_file_mprotect() definition, so that it can be registered > as implementation of the file_mprotect hook. > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> > --- > include/linux/ima.h | 5 +++-- > security/integrity/ima/ima_main.c | 6 ++++-- > security/security.c | 2 +- > 3 files changed, 8 insertions(+), 5 deletions(-) > > diff --git a/include/linux/ima.h b/include/linux/ima.h > index 910a2f11a906..b66353f679e8 100644 > --- a/include/linux/ima.h > +++ b/include/linux/ima.h > @@ -23,7 +23,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, > extern void ima_file_free(struct file *file); > extern int ima_file_mmap(struct file *file, unsigned long reqprot, > unsigned long prot, unsigned long flags); > -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); > +extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > + unsigned long prot); > extern int ima_load_data(enum kernel_load_data_id id, bool contents); > extern int ima_post_load_data(char *buf, loff_t size, > enum kernel_load_data_id id, char *description); > @@ -84,7 +85,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, > } > > static inline int ima_file_mprotect(struct vm_area_struct *vma, > - unsigned long prot) > + unsigned long reqprot, unsigned long prot) > { > return 0; > } > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index cc1217ac2c6f..b3f5e8401056 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -455,7 +455,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > /** > * ima_file_mprotect - based on policy, limit mprotect change > * @vma: vm_area_struct protection is set to > - * @prot: contains the protection that will be applied by the kernel. > + * @reqprot: protection requested by the application > + * @prot: protection that will be applied by the kernel > * > * Files can be mmap'ed read/write and later changed to execute to circumvent > * IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore > @@ -465,7 +466,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > * > * On mprotect change success, return 0. On failure, return -EACESS. > */ > -int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > + unsigned long prot) > { > struct ima_template_desc *template = NULL; > struct file *file; > diff --git a/security/security.c b/security/security.c > index d7b15ea67c3f..c87ba1bbd7dc 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -2819,7 +2819,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); > if (ret) > return ret; > - return ima_file_mprotect(vma, prot); > + return ima_file_mprotect(vma, reqprot, prot); > } > > /**
diff --git a/include/linux/ima.h b/include/linux/ima.h index 910a2f11a906..b66353f679e8 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -23,7 +23,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, extern void ima_file_free(struct file *file); extern int ima_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags); -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); +extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, + unsigned long prot); extern int ima_load_data(enum kernel_load_data_id id, bool contents); extern int ima_post_load_data(char *buf, loff_t size, enum kernel_load_data_id id, char *description); @@ -84,7 +85,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, } static inline int ima_file_mprotect(struct vm_area_struct *vma, - unsigned long prot) + unsigned long reqprot, unsigned long prot) { return 0; } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index cc1217ac2c6f..b3f5e8401056 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -455,7 +455,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, /** * ima_file_mprotect - based on policy, limit mprotect change * @vma: vm_area_struct protection is set to - * @prot: contains the protection that will be applied by the kernel. + * @reqprot: protection requested by the application + * @prot: protection that will be applied by the kernel * * Files can be mmap'ed read/write and later changed to execute to circumvent * IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore @@ -465,7 +466,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, * * On mprotect change success, return 0. On failure, return -EACESS. */ -int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, + unsigned long prot) { struct ima_template_desc *template = NULL; struct file *file; diff --git a/security/security.c b/security/security.c index d7b15ea67c3f..c87ba1bbd7dc 100644 --- a/security/security.c +++ b/security/security.c @@ -2819,7 +2819,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); if (ret) return ret; - return ima_file_mprotect(vma, prot); + return ima_file_mprotect(vma, reqprot, prot); } /**