Messages in this thread | | | Subject | Re: [PATCH 2/2] ima: add policy support for the new file open MAY_OPENEXEC flag | From | Lakshmi Ramasubramanian <> | Date | Wed, 29 Apr 2020 10:22:59 -0700 |
| |
On 4/29/20 6:38 AM, Mimi Zohar wrote: > The kernel has no way of differentiating between a file containing data > or code being opened by an interpreter. The proposed RESOLVE_MAYEXEC > openat2(2) flag bridges this gap by defining and enabling the MAY_OPENEXEC > flag. > > This patch adds IMA policy support for the new MAY_OPENEXEC flag. > > Example: > measure func=FILE_CHECK mask=^MAY_OPENEXEC > appraise func=FILE_CHECK appraise_type=imasig mask=^MAY_OPENEXEC > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed.
| |