Messages in this thread | | | Subject | Re: [PATCH bpf-next v3 2/3] bpf: Add a BPF helper for getting the IMA hash of an inode | From | Yonghong Song <> | Date | Tue, 24 Nov 2020 09:41:41 -0800 |
| |
On 11/24/20 7:12 AM, KP Singh wrote: > From: KP Singh <kpsingh@google.com> > > Provide a wrapper function to get the IMA hash of an inode. This helper > is useful in fingerprinting files (e.g executables on execution) and > using these fingerprints in detections like an executable unlinking > itself. > > Since the ima_inode_hash can sleep, it's only allowed for sleepable > LSM hooks. > > Signed-off-by: KP Singh <kpsingh@google.com>
Acked-by: Yonghong Song <yhs@fb.com>
| |