Commit 4235b1a4 authored Jun 10, 2020 by Mimi Zohar

ima: fix mprotect checking



Make sure IMA is enabled before checking mprotect change.  Addresses
report of a 3.7% regression of boot-time.dhcp.

Fixes: 8eb613c0 ("ima: verify mprotect change is consistent with mmap policy")
Reported-by: kernel test robot <rong.a.chen@intel.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Tested-by: Xing Zhengjun <zhengjun.xing@linux.intel.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

parent 42413b49

security/integrity/ima/ima_main.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -419,7 +419,8 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
		int pcr;

		/* Is mprotect making an mmap'ed file executable? */
		if (!vma->vm_file \|\| !(prot & PROT_EXEC) \|\| (vma->vm_flags & VM_EXEC))
		if (!(ima_policy_flag & IMA_APPRAISE) \|\| !vma->vm_file \|\|
		!(prot & PROT_EXEC) \|\| (vma->vm_flags & VM_EXEC))
		return 0;

		security_task_getsecid(current, &secid);

Admin message