Re: [PATCH 2/2] audit logging hashes (v4)

[Peter Moody <pmoody@xxxxxxxxxx>]

On Thu, Jun 7, 2012 at 12:17 PM, Eric Paris <eparis@xxxxxxxxxxxxxx> wrote:
> On Thu, Jun 7, 2012 at 3:03 PM, Peter Moody <pmoody@xxxxxxxxxx> wrote:
>
> Note that both of your patches appear to include whitespace damage
> (aka line wraps) such that they would not apply.

Sorry about that. I'll resend with git-send shortly (fixing the
audit_log_task_context() call and the documentation issue Mimi
mentioned which I forgot).

>> +void ima_audit_measurement(struct integrity_iint_cache *iint, struct
>> file *file)
>> +{
>> +       struct audit_buffer *ab;
>> +       char hash[(IMA_DIGEST_SIZE * 2) + 1];
>> +       int i;
>> +
>> +       if (iint->flags & IMA_AUDITED)
>> +               return;
>> +
>> +       for (i = 0; i < IMA_DIGEST_SIZE; i++)
>> +               snprintf(&(hash[i * 2]), 3, "%02x", iint->ima_xattr.digest[i]);
>> +
>> +       ab = audit_log_start(current->audit_context, GFP_KERNEL,
>> +                            AUDIT_INTEGRITY_RULE);
>> +       if (!ab)
>> +               return;
>> +
>> +       audit_log_d_path(ab, "path=", &file->f_path);
>> +       audit_log_format(ab, " hash=");
>> +       audit_log_untrustedstring(ab, hash);
>> +
>> +       audit_log_task_info(ab, current);
>> +       audit_log_task_context(ab);
>
> audit_log_task_info() already calls audit_log_task_context()....
>
>> +       audit_log_end(ab);
>> +
>> +       iint->flags |= IMA_AUDITED;
>> +}



-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html