Messages in this thread | | | Subject | Re: [PATCH bpf-next v3 1/3] ima: Implement ima_inode_hash | From | Daniel Borkmann <> | Date | Wed, 25 Nov 2020 13:17:23 +0100 |
| |
On 11/25/20 1:04 PM, KP Singh wrote: > On Tue, Nov 24, 2020 at 6:35 PM Yonghong Song <yhs@fb.com> wrote: >> On 11/24/20 7:12 AM, KP Singh wrote: >>> From: KP Singh <kpsingh@google.com> >>> >>> This is in preparation to add a helper for BPF LSM programs to use >>> IMA hashes when attached to LSM hooks. There are LSM hooks like >>> inode_unlink which do not have a struct file * argument and cannot >>> use the existing ima_file_hash API. >>> >>> An inode based API is, therefore, useful in LSM based detections like an >>> executable trying to delete itself which rely on the inode_unlink LSM >>> hook. >>> >>> Moreover, the ima_file_hash function does nothing with the struct file >>> pointer apart from calling file_inode on it and converting it to an >>> inode. >>> >>> Signed-off-by: KP Singh <kpsingh@google.com> >> >> There is no change for this patch compared to previous version, >> so you can carry my Ack. >> >> Acked-by: Yonghong Song <yhs@fb.com> > > I am guessing: > > * We need an Ack from Mimi/James.
Yes.
> * As regards to which tree, I guess bpf-next would be better since the > BPF helper and the selftest depends on it
Yep, bpf-next is my preference as otherwise we're running into unnecessary merge conflicts.
Thanks, Daniel
| |