ima: fix mprotect checking

Make sure IMA is enabled before checking mprotect change.  Addresses
report of a 3.7% regression of boot-time.dhcp.

Fixes: ed505b2b2e17 ("ima: verify mprotect change is consistent with mmap policy")
Reported-by: kernel test robot <rong.a.chen@intel.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Tested-by: Xing Zhengjun <zhengjun.xing@linux.intel.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 800fb3bba41838f2c6a292fc835893c9d26379db..c1583d98c5e5024e4e10b1729c88c6116cda1805 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -419,7 +419,8 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
        int pcr;
 
        /* Is mprotect making an mmap'ed file executable? */
-       if (!vma->vm_file || !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))
+       if (!(ima_policy_flag & IMA_APPRAISE) || !vma->vm_file ||
+           !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC))
                return 0;
 
        security_task_getsecid(current, &secid);