Commit 4235b1a4 authored by Mimi Zohar's avatar Mimi Zohar

ima: fix mprotect checking

Make sure IMA is enabled before checking mprotect change.  Addresses
report of a 3.7% regression of boot-time.dhcp.

Fixes: 8eb613c0 ("ima: verify mprotect change is consistent with mmap policy")
Reported-by: default avatarkernel test robot <rong.a.chen@intel.com>
Reviewed-by: default avatarLakshmi Ramasubramanian <nramas@linux.microsoft.com>
Tested-by: default avatarXing Zhengjun <zhengjun.xing@linux.intel.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 42413b49
...@@ -419,7 +419,8 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) ...@@ -419,7 +419,8 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
int pcr; int pcr;
/* Is mprotect making an mmap'ed file executable? */ /* Is mprotect making an mmap'ed file executable? */
if (!vma->vm_file || !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC)) if (!(ima_policy_flag & IMA_APPRAISE) || !vma->vm_file ||
!(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))
return 0; return 0;
security_task_getsecid(current, &secid); security_task_getsecid(current, &secid);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment