ima_file_mprotect(9)

📦 version 7.3.1, in nixpkgs unstable

💅 ima_file_mprotect(9) — Kernel API Manual

okay so bestie, pull up a chair, because we're talking about ima_file_mprotect — and the name literally tells you what it does: based on policy, limit mprotect change. that's it, that's the whole vibe. no cap. 🎀

✨ SYNOPSIS ✨

int ima_file_mprotect (struct vm_area_struct *vma , unsigned long
       reqprot , unsigned long prot );

yes the spacing is a little feral, we don't judge. 🦋

🌸 ARGUMENTS 🌸

  • vma — the vm_area_struct whose protection is being set. this is the little guy getting a glow-up (or not 💀).
  • reqprot — the protection the application is asking for. miss girl filed a request, we'll see if it gets approved.
  • prot — the protection the kernel is actually going to apply. yeah, those two aren't always the same, iykyk.

👑 DESCRIPTION 👑

okay so the whole plot: files can be mmap'ed read/write and then later flipped to execute — which is lowkey a way to circumvent IMA's mmap appraisal policy rules. sneaky sneaky 🙈. and the reason we can't just handle it at that moment is a locking situation: due to locking issues (the mmap semaphore would be taken before i_mutex), files can not be measured or appraised at this point. the locks said "not today."

so to eliminate this integrity gap, the kernel denies the mprotect PROT_EXECUTE change — if an mmap appraise policy rule exists. that's the entire slay. 🫶

on mprotect change success, return 0. on failure, return -EACESS.

💀 fair warning bestie: -EACESS is exactly how it's written here — letter for letter. do not "fix" it to -EACCES in your head and then wonder why greps aren't matching. copy it as-is, periodt.

🔥 SEE ALSO 🔥

kernel file ./security/integrity/ima/ima_main.c, plus the whole friend group:

mwah 💋 this little page lives over at ./security/integrity/ima, dated October 2026 — yes, the future, main character energy fr fr. go be iconic with your integrity checks bestie 🌈✨

📦 where this page comes from