kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

take calculation of final prot in security_mmap_file() into a helper

Browse source 
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2012-05-30 19:58:30 -04:00
parent 9ac4ed4bd0
commit 98de59bfe4
1 changed files with 28 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
security/security.c
View file

@ -660,36 +660,46 @@ int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
return security_ops->file_ioctl(file, cmd, arg); return security_ops->file_ioctl(file, cmd, arg);
} }
int security_mmap_file(struct file *file, unsigned long prot, static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
unsigned long flags)
{ {
unsigned long reqprot = prot;
int ret;
/* /*
* Does the application expect PROT_READ to imply PROT_EXEC? * Does we have PROT_READ and does the application expect
* * it to imply PROT_EXEC? If not, nothing to talk about...
* (the exception is when the underlying filesystem is noexec
* mounted, in which case we dont add PROT_EXEC.)
*/ */
if (!(reqprot & PROT_READ)) if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
goto out; return prot;
if (!(current->personality & READ_IMPLIES_EXEC)) if (!(current->personality & READ_IMPLIES_EXEC))
goto out; return prot;
if (!file) { /*
prot |= PROT_EXEC; * if that's an anonymous mapping, let it.
} else if (!(file->f_path.mnt->mnt_flags & MNT_NOEXEC)) { */
if (!file)
return prot | PROT_EXEC;
/*
* ditto if it's not on noexec mount, except that on !MMU we need
* BDI_CAP_EXEC_MMAP (== VM_MAYEXEC) in this case
*/
if (!(file->f_path.mnt->mnt_flags & MNT_NOEXEC)) {
#ifndef CONFIG_MMU #ifndef CONFIG_MMU
unsigned long caps = 0; unsigned long caps = 0;
struct address_space *mapping = file->f_mapping; struct address_space *mapping = file->f_mapping;
if (mapping && mapping->backing_dev_info) if (mapping && mapping->backing_dev_info)
caps = mapping->backing_dev_info->capabilities; caps = mapping->backing_dev_info->capabilities;
if (!(caps & BDI_CAP_EXEC_MAP)) if (!(caps & BDI_CAP_EXEC_MAP))
goto out; return prot;
#endif #endif
prot |= PROT_EXEC; return prot | PROT_EXEC;
} }
out: /* anything on noexec mount won't get PROT_EXEC */
ret = security_ops->mmap_file(file, reqprot, prot, flags); return prot;
}
int security_mmap_file(struct file *file, unsigned long prot,
unsigned long flags)
{
int ret;
ret = security_ops->mmap_file(file, prot,
mmap_prot(file, prot), flags);
if (ret) if (ret)
return ret; return ret;
return ima_file_mmap(file, prot); return ima_file_mmap(file, prot);