Re: [PATCH bpf-next v2 2/3] bpf: Add a BPF helper for getting the IMA hash of an inode

From: Yonghong Song
Date: Sat Nov 21 2020 - 01:57:08 EST




On 11/20/20 4:50 PM, KP Singh wrote:
From: KP Singh <kpsingh@xxxxxxxxxx>

Provide a wrapper function to get the IMA hash of an inode. This helper
is useful in fingerprinting files (e.g executables on execution) and
using these fingerprints in detections like an executable unlinking
itself.

Since the ima_inode_hash can sleep, it's only allowed for sleepable
LSM hooks.

Signed-off-by: KP Singh <kpsingh@xxxxxxxxxx>
Acked-by: Yonghong Song <yhs@xxxxxx>