From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E104C83004 for ; Wed, 29 Apr 2020 13:39:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 373FF206D6 for ; Wed, 29 Apr 2020 13:39:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728298AbgD2NjG (ORCPT ); Wed, 29 Apr 2020 09:39:06 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:24646 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728308AbgD2NjF (ORCPT ); Wed, 29 Apr 2020 09:39:05 -0400 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 03TDW8Jl120025; Wed, 29 Apr 2020 09:39:00 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 30mggvqc0s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 09:38:59 -0400 Received: from m0098409.ppops.net (m0098409.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 03TDWFfq120723; Wed, 29 Apr 2020 09:38:59 -0400 Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com with ESMTP id 30mggvqbwh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 09:38:58 -0400 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.0.27/8.16.0.27) with SMTP id 03TDUmZn003743; Wed, 29 Apr 2020 13:38:55 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma01fra.de.ibm.com with ESMTP id 30mcu8duh6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 29 Apr 2020 13:38:55 +0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 03TDcrwb54132832 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 29 Apr 2020 13:38:53 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 322BEAE051; Wed, 29 Apr 2020 13:38:53 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2BDF9AE055; Wed, 29 Apr 2020 13:38:52 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.162.91]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 29 Apr 2020 13:38:52 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Mickael Salaun , Steve Grubb , Jann Horn , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 0/2] ima: extending IMA policy to support interpreters Date: Wed, 29 Apr 2020 09:38:41 -0400 Message-Id: <1588167523-7866-1-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.676 definitions=2020-04-29_05:2020-04-29,2020-04-29 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 suspectscore=1 mlxscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 bulkscore=0 priorityscore=1501 malwarescore=0 clxscore=1015 mlxlogscore=883 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004290110 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On file open, the kernel has no way of differentiating between files containing data and those with code that will be executed. Only the interpreter knows how the file will be used. To bridge this gap, this patch set extends the IMA policy language: - to identify files with the executable mode bit set - to support the new file open flag MAY_OPENEXEC introduced by Mickael Salaun's "[PATCH v3 0/5] Add support for RESOLVE_MAYEXEC" patch set. Mimi Mimi Zohar (2): ima: add policy support for identifying file execute mode bit ima: add policy support for the new file open MAY_OPENEXEC flag Documentation/ABI/testing/ima_policy | 7 ++++--- security/integrity/ima/ima_main.c | 3 ++- security/integrity/ima/ima_policy.c | 33 +++++++++++++++++++++++++++------ 3 files changed, 33 insertions(+), 10 deletions(-) -- 2.7.5