| Message ID | 20230904133415.1799503-5-roberto.sassu@huaweicloud.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | security: Move IMA and EVM to the LSM infrastructure | expand |
On Mon, 2023-09-04 at 15:33 +0200, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > Change ima_file_mprotect() definition, so that it can be registered > as implementation of the file_mprotect hook. > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > --- > include/linux/ima.h | 5 +++-- > security/integrity/ima/ima_main.c | 6 ++++-- > security/security.c | 2 +- > 3 files changed, 8 insertions(+), 5 deletions(-) > > diff --git a/include/linux/ima.h b/include/linux/ima.h > index 893c3b98b4d0..56e72c0beb96 100644 > --- a/include/linux/ima.h > +++ b/include/linux/ima.h > @@ -24,7 +24,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, > extern void ima_file_free(struct file *file); > extern int ima_file_mmap(struct file *file, unsigned long reqprot, > unsigned long prot, unsigned long flags); > -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > + unsigned long prot); "extern" is needed here and similarly in 5/25. Mimi > extern int ima_load_data(enum kernel_load_data_id id, bool contents); > extern int ima_post_load_data(char *buf, loff_t size, > enum kernel_load_data_id id, char *description); > @@ -88,7 +89,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, > } > > static inline int ima_file_mprotect(struct vm_area_struct *vma, > - unsigned long prot) > + unsigned long reqprot, unsigned long prot) > { > return 0; > } > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 52e742d32f4b..e9e2a3ad25a1 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -441,7 +441,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > /** > * ima_file_mprotect - based on policy, limit mprotect change > * @vma: vm_area_struct protection is set to > - * @prot: contains the protection that will be applied by the kernel. > + * @reqprot: protection requested by the application > + * @prot: protection that will be applied by the kernel > * > * Files can be mmap'ed read/write and later changed to execute to circumvent > * IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore > @@ -451,7 +452,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > * > * On mprotect change success, return 0. On failure, return -EACESS. > */ > -int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > + unsigned long prot) > { > struct ima_template_desc *template = NULL; > struct file *file; > diff --git a/security/security.c b/security/security.c > index 96f2c68a1571..dffb67e6e119 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -2721,7 +2721,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); > if (ret) > return ret; > - return ima_file_mprotect(vma, prot); > + return ima_file_mprotect(vma, reqprot, prot); > } > > /**
On Wed, 2023-10-11 at 10:51 -0400, Mimi Zohar wrote: > On Mon, 2023-09-04 at 15:33 +0200, Roberto Sassu wrote: > > From: Roberto Sassu <roberto.sassu@huawei.com> > > > > Change ima_file_mprotect() definition, so that it can be registered > > as implementation of the file_mprotect hook. > > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > > --- > > include/linux/ima.h | 5 +++-- > > security/integrity/ima/ima_main.c | 6 ++++-- > > security/security.c | 2 +- > > 3 files changed, 8 insertions(+), 5 deletions(-) > > > > diff --git a/include/linux/ima.h b/include/linux/ima.h > > index 893c3b98b4d0..56e72c0beb96 100644 > > --- a/include/linux/ima.h > > +++ b/include/linux/ima.h > > @@ -24,7 +24,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, > > extern void ima_file_free(struct file *file); > > extern int ima_file_mmap(struct file *file, unsigned long reqprot, > > unsigned long prot, unsigned long flags); > > -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); > > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > + unsigned long prot); > > "extern" is needed here and similarly in 5/25. I removed because of a complain from checkpatch.pl --strict. Roberto > Mimi > > > extern int ima_load_data(enum kernel_load_data_id id, bool contents); > > extern int ima_post_load_data(char *buf, loff_t size, > > enum kernel_load_data_id id, char *description); > > @@ -88,7 +89,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, > > } > > > > static inline int ima_file_mprotect(struct vm_area_struct *vma, > > - unsigned long prot) > > + unsigned long reqprot, unsigned long prot) > > { > > return 0; > > } > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > > index 52e742d32f4b..e9e2a3ad25a1 100644 > > --- a/security/integrity/ima/ima_main.c > > +++ b/security/integrity/ima/ima_main.c > > @@ -441,7 +441,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > > /** > > * ima_file_mprotect - based on policy, limit mprotect change > > * @vma: vm_area_struct protection is set to > > - * @prot: contains the protection that will be applied by the kernel. > > + * @reqprot: protection requested by the application > > + * @prot: protection that will be applied by the kernel > > * > > * Files can be mmap'ed read/write and later changed to execute to circumvent > > * IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore > > @@ -451,7 +452,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, > > * > > * On mprotect change success, return 0. On failure, return -EACESS. > > */ > > -int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) > > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > + unsigned long prot) > > { > > struct ima_template_desc *template = NULL; > > struct file *file; > > diff --git a/security/security.c b/security/security.c > > index 96f2c68a1571..dffb67e6e119 100644 > > --- a/security/security.c > > +++ b/security/security.c > > @@ -2721,7 +2721,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); > > if (ret) > > return ret; > > - return ima_file_mprotect(vma, prot); > > + return ima_file_mprotect(vma, reqprot, prot); > > } > > > > /** >
On Wed, 2023-10-11 at 17:43 +0200, Roberto Sassu wrote: > On Wed, 2023-10-11 at 10:51 -0400, Mimi Zohar wrote: > > On Mon, 2023-09-04 at 15:33 +0200, Roberto Sassu wrote: > > > From: Roberto Sassu <roberto.sassu@huawei.com> > > > > > > Change ima_file_mprotect() definition, so that it can be registered > > > as implementation of the file_mprotect hook. > > > > > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > > > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > > > --- > > > include/linux/ima.h | 5 +++-- > > > security/integrity/ima/ima_main.c | 6 ++++-- > > > security/security.c | 2 +- > > > 3 files changed, 8 insertions(+), 5 deletions(-) > > > > > > diff --git a/include/linux/ima.h b/include/linux/ima.h > > > index 893c3b98b4d0..56e72c0beb96 100644 > > > --- a/include/linux/ima.h > > > +++ b/include/linux/ima.h > > > @@ -24,7 +24,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, > > > extern void ima_file_free(struct file *file); > > > extern int ima_file_mmap(struct file *file, unsigned long reqprot, > > > unsigned long prot, unsigned long flags); > > > -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); > > > +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, > > > + unsigned long prot); > > > > "extern" is needed here and similarly in 5/25. > > I removed because of a complain from checkpatch.pl --strict. Intermixing with/without "extern" looks weird. I would suggest removing all the externs as a separate patch, but they're being removed in "[PATCH v3 21/25] ima: Move to LSM infrastructure" anyway. For now I would include the "extern".
diff --git a/include/linux/ima.h b/include/linux/ima.h index 893c3b98b4d0..56e72c0beb96 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -24,7 +24,8 @@ extern void ima_post_create_tmpfile(struct mnt_idmap *idmap, extern void ima_file_free(struct file *file); extern int ima_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags); -extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, + unsigned long prot); extern int ima_load_data(enum kernel_load_data_id id, bool contents); extern int ima_post_load_data(char *buf, loff_t size, enum kernel_load_data_id id, char *description); @@ -88,7 +89,7 @@ static inline int ima_file_mmap(struct file *file, unsigned long reqprot, } static inline int ima_file_mprotect(struct vm_area_struct *vma, - unsigned long prot) + unsigned long reqprot, unsigned long prot) { return 0; } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 52e742d32f4b..e9e2a3ad25a1 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -441,7 +441,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, /** * ima_file_mprotect - based on policy, limit mprotect change * @vma: vm_area_struct protection is set to - * @prot: contains the protection that will be applied by the kernel. + * @reqprot: protection requested by the application + * @prot: protection that will be applied by the kernel * * Files can be mmap'ed read/write and later changed to execute to circumvent * IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore @@ -451,7 +452,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, * * On mprotect change success, return 0. On failure, return -EACESS. */ -int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) +int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, + unsigned long prot) { struct ima_template_desc *template = NULL; struct file *file; diff --git a/security/security.c b/security/security.c index 96f2c68a1571..dffb67e6e119 100644 --- a/security/security.c +++ b/security/security.c @@ -2721,7 +2721,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot); if (ret) return ret; - return ima_file_mprotect(vma, prot); + return ima_file_mprotect(vma, reqprot, prot); } /**