Commit 0298c5a9 authored by Roberto Sassu's avatar Roberto Sassu Committed by Paul Moore
Browse files

ima: Align ima_file_mprotect() definition with LSM infrastructure 



Change ima_file_mprotect() definition, so that it can be registered
as implementation of the file_mprotect hook.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: default avatarStefan Berger <stefanb@linux.ibm.com>
Reviewed-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent bad5247a

include/linux/ima.h

+3 −2
Original line number Diff line number Diff line
@@ -23,7 +23,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, 
extern void ima_file_free(struct file *file);

extern int ima_file_mmap(struct file *file, unsigned long reqprot,

			 unsigned long prot, unsigned long flags);

extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);

extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,

			     unsigned long prot);

extern int ima_load_data(enum kernel_load_data_id id, bool contents);

extern int ima_post_load_data(char *buf, loff_t size,

			      enum kernel_load_data_id id, char *description);
@@ -84,7 +85,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, 
}



static inline int ima_file_mprotect(struct vm_area_struct *vma,

				    unsigned long prot)

				    unsigned long reqprot, unsigned long prot)

{

	return 0;

}

security/integrity/ima/ima_main.c

+4 −2
Original line number Diff line number Diff line
@@ -455,7 +455,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, 
/**

 * ima_file_mprotect - based on policy, limit mprotect change

 * @vma: vm_area_struct protection is set to

 * @prot: contains the protection that will be applied by the kernel.

 * @reqprot: protection requested by the application

 * @prot: protection that will be applied by the kernel

 *

 * Files can be mmap'ed read/write and later changed to execute to circumvent

 * IMA's mmap appraisal policy rules.  Due to locking issues (mmap semaphore
@@ -465,7 +466,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, 
 *

 * On mprotect change success, return 0.  On failure, return -EACESS.

 */

int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)

int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,

		      unsigned long prot)

{

	struct ima_template_desc *template = NULL;

	struct file *file;

security/security.c

+1 −1
Original line number Diff line number Diff line
@@ -2831,7 +2831,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, 
	ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);

	if (ret)

		return ret;

	return ima_file_mprotect(vma, prot);

	return ima_file_mprotect(vma, reqprot, prot);

}



/**