On 4/29/20 6:38 AM, Mimi Zohar wrote:
The kernel has no way of differentiating between a file containing data or code being opened by an interpreter. The proposed RESOLVE_MAYEXEC openat2(2) flag bridges this gap by defining and enabling the MAY_OPENEXEC flag.This patch adds IMA policy support for the new MAY_OPENEXEC flag. Example: measure func=FILE_CHECK mask=^MAY_OPENEXEC appraise func=FILE_CHECK appraise_type=imasig mask=^MAY_OPENEXEC Signed-off-by: Mimi Zohar <[email protected]>
Reviewed.
