Skip to contentSkip to conversation

ima: use full pathnames in measurement list

PATCH New Mimi Zohar 1 participant 1 message Jun 27, 2012

Subsystems (3)
Security (LSM) Integrity measurement architecture (IMA) Extended Verification Module (EVM)
lore
Share & tools
lore

Mimi Zohar

author
#0 lore raw

PATCH 1/1 ima: use full pathnames in measurement list

The IMA measurement list contains filename hints, which can be ambigious without the full pathname. This patch replaces the filename hint with the full pathname, simplifying for userspace the correlating of file hash measurements with files.

Change log v1:
- Revert to short filenames, when full pathname is longer than IMA measurement buffer size. (Based on Dmitry's review)

Signed-off-by Mimi Zohar <[email protected]>
---
 security/integrity/ima/ima_api.c  |    4 ++-
 security/integrity/ima/ima_main.c |   42 +++++++++++++++++++++++++++++++-----
 2 files changed, 39 insertions(+), 7 deletions(-)
security/integrity/ima/ima_api.c +3 -1
index 88a2788..032ff03 100644
@@ -175,7 +175,9 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
 	}
 	memset(&entry->template, 0, sizeof(entry->template));
 	memcpy(entry->template.digest, iint->digest, IMA_DIGEST_SIZE);
-	strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
+	strcpy(entry->template.file_name,
+	       (strlen(filename) > IMA_EVENT_NAME_LEN_MAX) ?
+	       file->f_dentry->d_name.name : filename);
 
 	result = ima_store_template(entry, violation, inode);
 	if (!result || result == -EEXIST)
security/integrity/ima/ima_main.c +36 -6

68 lines not on this page · raw message

Signature · 1 line
1.7.7.6