ima: verify mprotect change is consistent with mmap policy (8eb613c0) · Commits · 戴 / test

include/linux/ima.h

+7 −0

Original line number	Original line	Diff line number	Diff line
	@@ -18,6 +18,7 @@ extern int ima_file_check(struct file *file, int mask);
	extern void ima_post_create_tmpfile(struct inode *inode);		extern void ima_post_create_tmpfile(struct inode *inode);
	extern void ima_file_free(struct file *file);		extern void ima_file_free(struct file *file);
	extern int ima_file_mmap(struct file *file, unsigned long prot);		extern int ima_file_mmap(struct file *file, unsigned long prot);
			extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
	extern int ima_load_data(enum kernel_load_data_id id);		extern int ima_load_data(enum kernel_load_data_id id);
	extern int ima_read_file(struct file *file, enum kernel_read_file_id id);		extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
	extern int ima_post_read_file(struct file file, void buf, loff_t size,		extern int ima_post_read_file(struct file file, void buf, loff_t size,
	@@ -70,6 +71,12 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot)
	return 0;		return 0;
	}		}

			static inline int ima_file_mprotect(struct vm_area_struct *vma,
			unsigned long prot)
			{
			return 0;
			}

	static inline int ima_load_data(enum kernel_load_data_id id)		static inline int ima_load_data(enum kernel_load_data_id id)
	{		{
	return 0;		return 0;

security/integrity/ima/ima_main.c

+51 −0

Original line number	Original line	Diff line number	Diff line
	@@ -393,6 +393,57 @@ int ima_file_mmap(struct file *file, unsigned long prot)
	return 0;		return 0;
	}		}

			/**
			* ima_file_mprotect - based on policy, limit mprotect change
			* @prot: contains the protection that will be applied by the kernel.
			*
			* Files can be mmap'ed read/write and later changed to execute to circumvent
			* IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore
			* would be taken before i_mutex), files can not be measured or appraised at
			* this point. Eliminate this integrity gap by denying the mprotect
			* PROT_EXECUTE change, if an mmap appraise policy rule exists.
			*
			* On mprotect change success, return 0. On failure, return -EACESS.
			*/
			int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
			{
			struct ima_template_desc *template;
			struct file *file = vma->vm_file;
			char filename[NAME_MAX];
			char *pathbuf = NULL;
			const char *pathname = NULL;
			struct inode *inode;
			int result = 0;
			int action;
			u32 secid;
			int pcr;

			/* Is mprotect making an mmap'ed file executable? */
			if (!vma->vm_file \|\| !(prot & PROT_EXEC) \|\| (vma->vm_flags & VM_EXEC))
			return 0;

			security_task_getsecid(current, &secid);
			inode = file_inode(vma->vm_file);
			action = ima_get_action(inode, current_cred(), secid, MAY_EXEC,
			MMAP_CHECK, &pcr, &template, 0);

			/* Is the mmap'ed file in policy? */
			if (!(action & (IMA_MEASURE \| IMA_APPRAISE_SUBMASK)))
			return 0;

			if (action & IMA_APPRAISE_SUBMASK)
			result = -EPERM;

			file = vma->vm_file;
			pathname = ima_d_path(&file->f_path, &pathbuf, filename);
			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname,
			"collect_data", "failed-mprotect", result, 0);
			if (pathbuf)
			__putname(pathbuf);

			return result;
			}

	/**		/**
	* ima_bprm_check - based on policy, collect/store measurement.		* ima_bprm_check - based on policy, collect/store measurement.
	* @bprm: contains the linux_binprm structure		* @bprm: contains the linux_binprm structure

security/security.c

+6 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1512,7 +1512,12 @@ int security_mmap_addr(unsigned long addr)
	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,		int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
	unsigned long prot)		unsigned long prot)
	{		{
	return call_int_hook(file_mprotect, 0, vma, reqprot, prot);		int ret;

			ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);
			if (ret)
			return ret;
			return ima_file_mprotect(vma, prot);
	}		}

	int security_file_lock(struct file *file, unsigned int cmd)		int security_file_lock(struct file *file, unsigned int cmd)

Admin message