Re: How to get full pathname from an inode?

From: Omen Wild (Omen.Wildat_private)
Date: Thu Jul 24 2003 - 10:26:02 PDT

  • Next message: Seth Arnold: "Re: How to get full pathname from an inode?"

    Quoting David Wagner <dawat_private> on Thu, Jul 24 17:12:
    >
    > Out of curiousity, why do you want the path name?
    
    I am trying to build a module that checks the SHA1 hash of files as
    they get loaded and compare it to a SHA1 hash previously calculated and
    stored.  If any critical files have been modified then warnings can get
    logged, access can be denied, or if the file was critical enough, the
    system can be shut down.  I need the path name to do a filp_open call.
    Baring that, I need the vfsmount of / so I can do a dentry_open.
    
    Think of it as a kind of runtime TripWire.  I realize there are a bunch
    of issues dealing with database integrity and kernel integrity, but we
    are not quite ready to talk about how we have solved those yet.  In a
    couple weeks we will go public with the project and that part will make
    sense.
    
    My thought was to build a database of filename / SHA1 pairs and load
    that when the module initializes.  If I use any other reference like
    kdev_t,ino_t pairs then there are some cases that I can think of that
    cannot be caught properly.
    
    -- 
    T-Shirt saying: The torture never stops.
    
    
    

    _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module



    This archive was generated by hypermail 2b30 : Thu Jul 24 2003 - 10:26:40 PDT