Files
linux-stable-mirror/include/linux
Mimi Zohar 8eb613c0b8 ima: verify mprotect change is consistent with mmap policy
Files can be mmap'ed read/write and later changed to execute to circumvent
IMA's mmap appraise policy rules.  Due to locking issues (mmap semaphore
would be taken prior to i_mutex), files can not be measured or appraised at
this point.  Eliminate this integrity gap, by denying the mprotect
PROT_EXECUTE change, if an mmap appraise policy rule exists.

On mprotect change success, return 0.  On failure, return -EACESS.

Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2020-05-22 14:41:04 -04:00
..
2020-03-31 21:29:04 +02:00
2020-04-10 15:36:21 -07:00
2020-04-15 11:48:21 +02:00
2020-04-10 15:36:21 -07:00
2020-04-07 10:43:38 -07:00
2020-04-02 09:35:27 -07:00
2020-04-07 10:43:38 -07:00
2020-04-09 12:15:35 -05:00
2020-04-07 10:43:42 -07:00
2020-04-01 12:06:26 -04:00
2020-04-01 12:06:26 -04:00
2020-04-01 12:06:26 -04:00