Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <1588627060-7399-1-git-send-email-zohar@linux.ibm.com>
In-Reply-To: <1588627060-7399-1-git-send-email-zohar@linux.ibm.com>
From:   Jann Horn <jannh@google.com>
Date:   Tue, 5 May 2020 02:15:56 +0200
Message-ID: <CAG48ez2PwqoDBx0pkZKFHvMXHNqAc8AfuTR5oPoF-obHqUo0zQ@mail.gmail.com>
Subject: Re: [RFC PATCH] ima: verify mprotect change is consistent with mmap policy
To:     Mimi Zohar <zohar@linux.ibm.com>
Cc:     linux-integrity@vger.kernel.org,
        Stephen Smalley <stephen.smalley.work@gmail.com>,
        Eric Biggers <ebiggers@kernel.org>,
        linux-security-module <linux-security-module@vger.kernel.org>,
        kernel list <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, May 4, 2020 at 11:18 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
> Files can be mmap'ed read/write and later changed to execute to circumvent
> IMA's mmap appraise policy rules.  Due to locking issues (mmap semaphore
> would be taken prior to i_mutex), files can not be measured or appraised at
> this point.  Eliminate this integrity gap, by denying the mprotect
> PROT_EXECUTE change, if an mmap appraise policy rule exists.

Just keep in mind that there are other ways to create executable
mappings containing controlled code; e.g. PROT_EXEC with
MAP_ANONYMOUS, or writing to /proc/self/mem (which is a debugging API
that works entirely without ever making the VMA writable - I had an
old series to provide LSM hooks for that stuff at
<https://lore.kernel.org/lkml/1478142286-18427-3-git-send-email-jann@thejh.net/>,
but I guess I must have forgotten about it or something...).