mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-11-01 09:04:25 +00:00
d80e880f28
This is a project with a v1 of the IMA namespacing patches. See the readme for details on use. Signed-off-by: Tycho Andersen <tycho@docker.com>
53 lines
1.9 KiB
Diff
53 lines
1.9 KiB
Diff
From 9eb525d553c6aa296f9396e192a37e453b30d5f9 Mon Sep 17 00:00:00 2001
|
|
From: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
|
|
Date: Tue, 9 May 2017 10:36:16 -0300
|
|
Subject: [PATCH 02/11] ima: qualify pathname in audit measurement record
|
|
|
|
Adding new fields (mount namespace id, file inode and device name) to
|
|
uniquely identify a pathname considering different mount namespaces.
|
|
The file inode on a given device is unique and these fields are
|
|
required to identify a namespace id since this id can be released
|
|
and later reused by a different namespace.
|
|
|
|
Signed-off-by: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
|
|
---
|
|
security/integrity/ima/ima_api.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
|
|
index c2edba8..b05c1fd 100644
|
|
--- a/security/integrity/ima/ima_api.c
|
|
+++ b/security/integrity/ima/ima_api.c
|
|
@@ -18,6 +18,7 @@
|
|
#include <linux/fs.h>
|
|
#include <linux/xattr.h>
|
|
#include <linux/evm.h>
|
|
+#include <linux/proc_ns.h>
|
|
|
|
#include "ima.h"
|
|
|
|
@@ -293,6 +294,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
|
|
char hash[(iint->ima_hash->length * 2) + 1];
|
|
const char *algo_name = hash_algo_name[iint->ima_hash->algo];
|
|
char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
|
|
+ struct ns_common *ns;
|
|
int i;
|
|
|
|
if (iint->flags & IMA_AUDITED)
|
|
@@ -312,6 +314,12 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
|
|
audit_log_format(ab, " hash=");
|
|
snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
|
|
audit_log_untrustedstring(ab, algo_hash);
|
|
+ ns = mntns_operations.get(current);
|
|
+ audit_log_format(ab, " mnt_ns=%u", ns->inum);
|
|
+ mntns_operations.put(ns);
|
|
+ audit_log_format(ab, " dev=");
|
|
+ audit_log_untrustedstring(ab, iint->inode->i_sb->s_id);
|
|
+ audit_log_format(ab, " ino=%lu", iint->inode->i_ino);
|
|
|
|
audit_log_task_info(ab, current);
|
|
audit_log_end(ab);
|
|
--
|
|
2.9.3
|
|
|