lua-lsm: add file_mprotect context

[chenzongyao200127]

Lua-LSM currently exposes file_mprotect() with only the requested and effective protection masks. That leaves Lua policy to infer intent from raw bits, and hides useful VMA context such as whether the region is anonymous, file-backed, shared, stack, heap, gaining execute permission, or becoming writable and executable.

Add an mprotect context userdata for file_mprotect(). The context exposes derived VMA attributes and a file() accessor for file-backed mappings, while preserving the raw reqprot and prot arguments for policy that wants to inspect the original protection masks.

Example Lua policy:

return {
    name = "mprotect-policy",
    author = "Zongyao Chen",
    license = "GPL",

    file_mprotect = function(ctx, reqprot, prot)
        if ctx.wx then
            return false, errno.EPERM
        end

        if ctx.gaining_exec and ctx.anonymous and not ctx.stack then
            return false, errno.EPERM
        end

        if ctx.file_backed and ctx.write_to_exec then
            local file = ctx:file()
            local path = file and file:path()
            if path and path:match("^/tmp/") then
                return false, errno.EPERM
            end
        end

        return true
    end,
}

Validation:

• ./scripts/checkpatch.pl --git origin/lua-lsm..lua-lsm-file-mprotect
  • reports only: added, moved or deleted file(s), does MAINTAINERS need updating?
• git diff --check origin/lua-lsm..lua-lsm-file-mprotect

Signed-off-by: Zongyao Chen ZongYao.Chen@linux.alibaba.com