Mimi Zohar 8eb613c0b8 ima: verify mprotect change is consistent with mmap policy ... Files can be mmap'ed read/write and later changed to execute to circumvent IMA's mmap appraise policy rules. Due to locking issues (mmap semaphore would be taken prior to i_mutex), files can not be measured or appraised at this point. Eliminate this integrity gap, by denying the mprotect PROT_EXECUTE change, if an mmap appraise policy rule exists. On mprotect change success, return 0. On failure, return -EACESS. Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>		2020-05-22 14:41:04 -04:00
..
apparmor	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
bpf	bpf: lsm: Initialize the BPF LSM hooks	2020-03-30 01:34:00 +02:00
integrity	ima: verify mprotect change is consistent with mmap policy	2020-05-22 14:41:04 -04:00
keys	keys: Fix proc_keys_next to increase position index	2020-04-16 10:10:50 -07:00
loadpin	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
lockdown	security,lockdown,selinux: implement SELinux lockdown	2019-12-09 17:53:58 -05:00
safesetid	security/safesetid: Replace rcu_swap_protected() with rcu_replace_pointer()	2019-10-30 08:45:57 -07:00
selinux	selinux/stable-5.7 PR 20200416	2020-04-16 10:45:47 -07:00
smack	Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-02-08 13:26:41 -08:00
tomoyo	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
yama	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
commoncap.c	Merge branch 'next-lsm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-07-09 12:24:21 -07:00
device_cgroup.c	device_cgroup: Export devcgroup_check_permission	2019-10-07 15:11:38 -05:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
Kconfig	bpf: lsm: Initialize the BPF LSM hooks	2020-03-30 01:34:00 +02:00
Kconfig.hardening	meminit fix	2019-07-28 12:33:15 -07:00
lsm_audit.c	security,lockdown,selinux: implement SELinux lockdown	2019-12-09 17:53:58 -05:00
Makefile	bpf: lsm: Initialize the BPF LSM hooks	2020-03-30 01:34:00 +02:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	ima: verify mprotect change is consistent with mmap policy	2020-05-22 14:41:04 -04:00