Messages in this thread | | | Subject | Re: [PATCH bpf-next v2 2/3] bpf: Add a BPF helper for getting the IMA hash of an inode | From | Yonghong Song <> | Date | Fri, 20 Nov 2020 22:54:27 -0800 |
| |
On 11/20/20 4:50 PM, KP Singh wrote: > From: KP Singh <kpsingh@google.com> > > Provide a wrapper function to get the IMA hash of an inode. This helper > is useful in fingerprinting files (e.g executables on execution) and > using these fingerprints in detections like an executable unlinking > itself. > > Since the ima_inode_hash can sleep, it's only allowed for sleepable > LSM hooks. > > Signed-off-by: KP Singh <kpsingh@google.com> Acked-by: Yonghong Song <yhs@fb.com>
| |