From 9eb525d553c6aa296f9396e192a37e453b30d5f9 Mon Sep 17 00:00:00 2001 From: Guilherme Magalhaes Date: Tue, 9 May 2017 10:36:16 -0300 Subject: [PATCH 02/11] ima: qualify pathname in audit measurement record Adding new fields (mount namespace id, file inode and device name) to uniquely identify a pathname considering different mount namespaces. The file inode on a given device is unique and these fields are required to identify a namespace id since this id can be released and later reused by a different namespace. Signed-off-by: Guilherme Magalhaes --- security/integrity/ima/ima_api.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index c2edba8..b05c1fd 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -18,6 +18,7 @@ #include #include #include +#include #include "ima.h" @@ -293,6 +294,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, char hash[(iint->ima_hash->length * 2) + 1]; const char *algo_name = hash_algo_name[iint->ima_hash->algo]; char algo_hash[sizeof(hash) + strlen(algo_name) + 2]; + struct ns_common *ns; int i; if (iint->flags & IMA_AUDITED) @@ -312,6 +314,12 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, audit_log_format(ab, " hash="); snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash); audit_log_untrustedstring(ab, algo_hash); + ns = mntns_operations.get(current); + audit_log_format(ab, " mnt_ns=%u", ns->inum); + mntns_operations.put(ns); + audit_log_format(ab, " dev="); + audit_log_untrustedstring(ab, iint->inode->i_sb->s_id); + audit_log_format(ab, " ino=%lu", iint->inode->i_ino); audit_log_task_info(ab, current); audit_log_end(ab); -- 2.9.3