I'm writing a LSM to implement part of Tripwire's functionality at runtime, specifically, SHA1 checking. What I want to do is verify the SHA1 hash of the file that being opened is the same as a previously computed hash. I want to ensure (when they are opened) that files have not been modified from their previous contents. I've successfully tapped the kernel at the inode_permission security check. This gives me what I want, and I have everything set up, except for actually reading the contents of the file off disk and feeding them to the hash function. Can anyone give me some pointers for how to read a file's contents when what I have is an inode? Thanks, Omen -- There are very few personal problems that cannot be solved through a suitable application of high explosives.
This archive was generated by hypermail 2b30 : Wed Jul 16 2003 - 12:55:17 PDT