2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-25 21:54:06 +08:00
linux-next/security/integrity/ima
Roberto Sassu 1b68bdf9cd ima: detect violations for mmaped files
This patch fixes the detection of the 'open_writers' violation for mmaped
files.

before) an 'open_writers' violation is detected if the policy contains
        a rule with the criteria: func=FILE_CHECK mask=MAY_READ

after) an 'open_writers' violation is detected if the current event
       matches one of the policy rules.

With the old behaviour, the 'open_writers' violation is not detected
in the following case:

policy:
measure func=FILE_MMAP mask=MAY_EXEC

steps:
1) open a shared library for writing
2) execute a binary that links that shared library
3) during the binary execution, modify the shared library and save
   the change

result:
the 'open_writers' violation measurement is not present in the IMA list.

Only binaries executed are protected from writes. For libraries mapped
in memory there is the flag MAP_DENYWRITE for this purpose, but according
to the output of 'man mmap', the mmap flag is ignored.

Since ima_rdwr_violation_check() is now called by process_measurement()
the information about if the inode must be measured is already provided
by ima_get_action(). Thus the unnecessary function ima_must_measure()
has been removed.

Changes in v3 (Dmitry Kasatkin):
- Violation for MMAP_CHECK function are verified since this patch
- Changed patch description a bit

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
2014-09-18 10:04:12 -04:00
..
ima_api.c ima: detect violations for mmaped files 2014-09-18 10:04:12 -04:00
ima_appraise.c ima: added ima_policy_flag variable 2014-09-17 16:39:36 -04:00
ima_crypto.c ima: add missing '__init' keywords 2014-09-09 10:28:50 -04:00
ima_fs.c integrity: fix checkpatch errors 2014-03-07 12:15:45 -05:00
ima_init.c ima: return an error code from ima_add_boot_aggregate() 2014-09-17 16:15:42 -04:00
ima_main.c ima: detect violations for mmaped files 2014-09-18 10:04:12 -04:00
ima_policy.c ima: added ima_policy_flag variable 2014-09-17 16:39:36 -04:00
ima_queue.c integrity: fix checkpatch errors 2014-03-07 12:15:45 -05:00
ima_template_lib.c ima: reduce memory usage when a template containing the n field is used 2014-03-07 11:32:30 -05:00
ima_template_lib.h ima: extend the measurement list to include the file signature 2013-10-31 20:19:35 -04:00
ima_template.c ima: initialize only required template 2014-09-09 10:28:54 -04:00
ima.h ima: added ima_policy_flag variable 2014-09-17 16:39:36 -04:00
Kconfig integrity: base integrity subsystem kconfig options on integrity 2014-09-09 10:28:56 -04:00
Makefile ima: define template fields library and new helpers 2013-10-25 17:17:05 -04:00