diff options
| author | Roberto Sassu <roberto.sassu@huawei.com> | 2023-01-31 18:42:44 +0100 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2023-01-31 13:08:39 -0500 |
| commit | 4958db3245fa655bf18251bd2a83bcc164071c39 (patch) | |
| tree | b6b923f3e8587a7a50b6e1bd466ff0b5d65cbcbd /security/integrity/ima/ima_api.c | |
| parent | 4971c268b85e1c7a734a61622fc0813c86e2362e (diff) | |
| download | linux-stable-4958db3245fa655bf18251bd2a83bcc164071c39.tar.gz linux-stable-4958db3245fa655bf18251bd2a83bcc164071c39.tar.bz2 linux-stable-4958db3245fa655bf18251bd2a83bcc164071c39.zip | |
ima: Introduce MMAP_CHECK_REQPROT hook
Commit 98de59bfe4b2f ("take calculation of final prot in
security_mmap_file() into a helper") caused ima_file_mmap() to receive the
protections requested by the application and not those applied by the
kernel.
After restoring the original MMAP_CHECK behavior, existing attestation
servers might be broken due to not being ready to handle new entries
(previously missing) in the IMA measurement list.
Restore the original correct MMAP_CHECK behavior, instead of keeping the
current buggy one and introducing a new hook with the correct behavior.
Otherwise, there would have been the risk of IMA users not noticing the
problem at all, as they would actively have to update the IMA policy, to
switch to the correct behavior.
Also, introduce the new MMAP_CHECK_REQPROT hook to keep the current
behavior, so that IMA users could easily fix a broken attestation server,
although this approach is discouraged due to potentially missing
measurements.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/integrity/ima/ima_api.c')
| -rw-r--r-- | security/integrity/ima/ima_api.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 1e3a7a4f8833..635803b0d522 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -179,7 +179,8 @@ err_out: * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK - * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA + * | KEXEC_CMDLINE | KEY_CHECK | CRITICAL_DATA | SETXATTR_CHECK + * | MMAP_CHECK_REQPROT * mask: contains the permission mask * fsmagic: hex value * |