@@ -1890,6 +1890,13 @@
different crypto accelerators. This option can be used
to achieve best performance for particular HW.
+ ima.rawpath= [IMA]
+ Format: <bool>
+ Default: 0
+ This parameter controls whether the IMA measurement
+ list contains the relative or raw full file pathnames
+ in the IMA measurement list.
+
init= [KNL]
Format: <full_path>
Run specified binary instead of /sbin/init as init
@@ -9,14 +9,19 @@
* appraise_measurement, store_measurement and store_template.
*/
#include <linux/slab.h>
+#include <linux/moduleparam.h>
#include <linux/file.h>
#include <linux/fs.h>
+#include <linux/fs_struct.h>
#include <linux/xattr.h>
#include <linux/evm.h>
#include <linux/iversion.h>
#include "ima.h"
+static bool rawpath_enabled;
+module_param_named(rawpath, rawpath_enabled, bool, 0);
+
/*
* ima_free_template_entry - free an existing template entry
*/
@@ -390,11 +395,22 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
*/
const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
{
+ struct dentry *dentry = NULL;
char *pathname = NULL;
*pathbuf = __getname();
if (*pathbuf) {
- pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
+ if (!rawpath_enabled) {
+ pathname = d_absolute_path(path, *pathbuf, PATH_MAX);
+ } else {
+ /* Use union/overlay full pathname */
+ if (unlikely(path->dentry->d_flags & DCACHE_OP_REAL))
+ dentry = d_real(path->dentry, NULL);
+ else
+ dentry = path->dentry;
+ pathname = dentry_path_raw(dentry, *pathbuf, PATH_MAX);
+ }
+
if (IS_ERR(pathname)) {
__putname(*pathbuf);
*pathbuf = NULL;
Relative file pathnames are included in the IMA measurement list making it difficult to differentiate files. Permit replacing the relative pathname with the (raw) full pathname in the measurement list. Define a new module param named "ima.rawpath". Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- comment: this change does not address the simple "unshare -m" case without pivot_root. .../admin-guide/kernel-parameters.txt | 7 +++++++ security/integrity/ima/ima_api.c | 18 +++++++++++++++++- 2 files changed, 24 insertions(+), 1 deletion(-)