Re: [PATCH v2] security: Restore passing final prot to ima_file_mmap()
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2023-01-22 20:30:35
Also in:
linux-integrity, lkml, stable
On Fri, 2023-01-13 at 11:52 +0100, Roberto Sassu wrote:
quoted
quoted
If we add a new policy keyword, existing policies would not be updated unless the system administrator notices it. If a remote attestation fails, the administrator has to look into it.Verifying the measurement list against a TPM quote should work regardless of additional measurements. The attestation server, however, should also check for unknown files.quoted
Maybe we can introduce a new hook called MMAP_CHECK_REQ, so that an administrator could change the policy to have the current behavior, if the administrator wishes so.
<snip>
quoted
However "_REQ" could mean either requested or required.It was to recall reqprot. I could rename to MMAP_CHECK_REQPROT.
That sounds good. -- thanks, Mimib