Re: [Linux-ima-user] Measurement list and path of measured files

[Mimi Z. <zo...@li...>]

On Wed, 2012-06-13 at 14:32 +0200, Jordi Cucurull Juan wrote:
> Dear all,
> 
> Recently I have started looking at IMA to explore the possibilities that 
> it offers. I have a question regarding the measurement list and the 
> files measured.
> 
> The point is that it does not seem possible to uniquely identify a file 
> with the information in the field "file-hint". The absolute path of the 
> file is not always available, hence in many cases several entries with 
> the same file name will appear. This makes impossible to distinguish if 
> two entries with the same file-hint value correspond to two different 
> files in the file system or to a file that has been modified.
> 
> Is it possible to include the file name with the complete absolute path 
> in the measurement list? If not, is there a reason for it? (maybe memory 
> used by the list?)
> 
> Thanks and best regards,
> Jordi.

Yes, this is a common complaint, which we started to address with
additional metadata (eg. uid/gid, LSM object/subject labels) -
http://sourceforge.net/mailarchive/message.php?msg_id=25460938, but
haven't yet upstreamed.  At the time, using d_path() in the critical
code path was not permitted.  Perhaps things have changed.  This exact
question was just asked on the LSM mailing list, but has not yet been
answered.

Mimi