Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1639877

[RFC 02/11] ima: qualify pathname in audit measurement record

Show all headers | View raw

Adding new fields (mount namespace id, file inode and device name) to
uniquely identify a pathname considering different mount namespaces.
The file inode on a given device is unique and these fields are
required to identify a namespace id since this id can be released
and later reused by a different namespace.

Signed-off-by: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
---
 security/integrity/ima/ima_api.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index c2edba8..b05c1fd 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -18,6 +18,7 @@
 #include <linux/fs.h>
 #include <linux/xattr.h>
 #include <linux/evm.h>
+#include <linux/proc_ns.h>
 
 #include "ima.h"
 
@@ -293,6 +294,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
 	char hash[(iint->ima_hash->length * 2) + 1];
 	const char *algo_name = hash_algo_name[iint->ima_hash->algo];
 	char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
+	struct ns_common *ns;
 	int i;
 
 	if (iint->flags & IMA_AUDITED)
@@ -312,6 +314,12 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
 	audit_log_format(ab, " hash=");
 	snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
 	audit_log_untrustedstring(ab, algo_hash);
+	ns = mntns_operations.get(current);
+	audit_log_format(ab, " mnt_ns=%u", ns->inum);
+	mntns_operations.put(ns);
+	audit_log_format(ab, " dev=");
+	audit_log_untrustedstring(ab, iint->inode->i_sb->s_id);
+	audit_log_format(ab, " ino=%lu", iint->inode->i_ino);
 
 	audit_log_task_info(ab, current);
 	audit_log_end(ab);
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC 00/11] ima: namespace support for IMA policy Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 01/11] ima: qualify pathname in audit info record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 04/11] ima: add support to namespace securityfs file Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Tycho Andersen <tycho@docker.com> - 2017-05-18 23:40 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-05-24 22:20 +0200
  [RFC 02/11] ima: qualify pathname in audit measurement record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 10/11] ima: handling all policy flags per namespace using ima_ns_policy structure Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 07/11] ima: new namespace policy structure to track initial namespace policy data Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 08/11] ima: block initial namespace id on the namespace policy interface Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 05/11] ima: store new namespace policy structure in a radix tree Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 06/11] ima, fs: release namespace policy resources Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 09/11] ima: delete namespace policy securityfs file in write-once mode Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200

csiph-web