[deliverable/linux.git] / security / integrity / ima / ima_api.c

/*
 * Copyright (C) 2008 IBM Corporation
 *
 * Author: Mimi Zohar <zohar@us.ibm.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 *
 * File: ima_api.c
 *	Implements must_appraise_or_measure, collect_measurement,
 *	appraise_measurement, store_measurement and store_template.
 */
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/xattr.h>
#include <linux/evm.h>
#include <crypto/hash_info.h>
#include "ima.h"

/*
 * ima_free_template_entry - free an existing template entry
 */
void ima_free_template_entry(struct ima_template_entry *entry)
{
	int i;

	for (i = 0; i < entry->template_desc->num_fields; i++)
		kfree(entry->template_data[i].data);

	kfree(entry);
}

/*
 * ima_alloc_init_template - create and initialize a new template entry
 */
int ima_alloc_init_template(struct integrity_iint_cache *iint,
			    struct file *file, const unsigned char *filename,
			    struct evm_ima_xattr_data *xattr_value,
			    int xattr_len, struct ima_template_entry **entry)
{
	struct ima_template_desc *template_desc = ima_template_desc_current();
	int i, result = 0;

	*entry = kzalloc(sizeof(**entry) + template_desc->num_fields *
			 sizeof(struct ima_field_data), GFP_NOFS);
	if (!*entry)
		return -ENOMEM;

	(*entry)->template_desc = template_desc;
	for (i = 0; i < template_desc->num_fields; i++) {
		struct ima_template_field *field = template_desc->fields[i];
		u32 len;

		result = field->field_init(iint, file, filename,
					   xattr_value, xattr_len,
					   &((*entry)->template_data[i]));
		if (result != 0)
			goto out;

		len = (*entry)->template_data[i].len;
		(*entry)->template_data_len += sizeof(len);
		(*entry)->template_data_len += len;
	}
	return 0;
out:
	ima_free_template_entry(*entry);
	*entry = NULL;
	return result;
}

/*
 * ima_store_template - store ima template measurements
 *
 * Calculate the hash of a template entry, add the template entry
 * to an ordered list of measurement entries maintained inside the kernel,
 * and also update the aggregate integrity value (maintained inside the
 * configured TPM PCR) over the hashes of the current list of measurement
 * entries.
 *
 * Applications retrieve the current kernel-held measurement list through
 * the securityfs entries in /sys/kernel/security/ima. The signed aggregate
 * TPM PCR (called quote) can be retrieved using a TPM user space library
 * and is used to validate the measurement list.
 *
 * Returns 0 on success, error code otherwise
 */
int ima_store_template(struct ima_template_entry *entry,
		       int violation, struct inode *inode,
		       const unsigned char *filename)
{
	const char *op = "add_template_measure";
	const char *audit_cause = "hashing_error";
	char *template_name = entry->template_desc->name;
	int result;
	struct {
		struct ima_digest_data hdr;
		char digest[TPM_DIGEST_SIZE];
	} hash;

	if (!violation) {
		int num_fields = entry->template_desc->num_fields;

		/* this function uses default algo */
		hash.hdr.algo = HASH_ALGO_SHA1;
		result = ima_calc_field_array_hash(&entry->template_data[0],
						   entry->template_desc,
						   num_fields, &hash.hdr);
		if (result < 0) {
			integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
					    template_name, op,
					    audit_cause, result, 0);
			return result;
		}
		memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
	}
	result = ima_add_template_entry(entry, violation, op, inode, filename);
	return result;
}

/*
 * ima_add_violation - add violation to measurement list.
 *
 * Violations are flagged in the measurement list with zero hash values.
 * By extending the PCR with 0xFF's instead of with zeroes, the PCR
 * value is invalidated.
 */
void ima_add_violation(struct file *file, const unsigned char *filename,
		       const char *op, const char *cause)
{
	struct ima_template_entry *entry;
	struct inode *inode = file_inode(file);
	int violation = 1;
	int result;

	/* can overflow, only indicator */
	atomic_long_inc(&ima_htable.violations);

	result = ima_alloc_init_template(NULL, file, filename,
					 NULL, 0, &entry);
	if (result < 0) {
		result = -ENOMEM;
		goto err_out;
	}
	result = ima_store_template(entry, violation, inode, filename);
	if (result < 0)
		ima_free_template_entry(entry);
err_out:
	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
			    op, cause, result, 0);
}

/**
 * ima_get_action - appraise & measure decision based on policy.
 * @inode: pointer to inode to measure
 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
 * @function: calling function (FILE_CHECK, BPRM_CHECK, MMAP_CHECK, MODULE_CHECK)
 *
 * The policy is defined in terms of keypairs:
 * 		subj=, obj=, type=, func=, mask=, fsmagic=
 *	subj,obj, and type: are LSM specific.
 * 	func: FILE_CHECK | BPRM_CHECK | MMAP_CHECK | MODULE_CHECK
 * 	mask: contains the permission mask
 *	fsmagic: hex value
 *
 * Returns IMA_MEASURE, IMA_APPRAISE mask.
 *
 */
int ima_get_action(struct inode *inode, int mask, int function)
{
	int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE;

	if (!ima_appraise)
		flags &= ~IMA_APPRAISE;

	return ima_match_policy(inode, function, mask, flags);
}

int ima_must_measure(struct inode *inode, int mask, int function)
{
	return ima_match_policy(inode, function, mask, IMA_MEASURE);
}

/*
 * ima_collect_measurement - collect file measurement
 *
 * Calculate the file hash, if it doesn't already exist,
 * storing the measurement and i_version in the iint.
 *
 * Must be called with iint->mutex held.
 *
 * Return 0 on success, error code otherwise
 */
int ima_collect_measurement(struct integrity_iint_cache *iint,
			    struct file *file,
			    struct evm_ima_xattr_data **xattr_value,
			    int *xattr_len)
{
	struct inode *inode = file_inode(file);
	const char *filename = file->f_dentry->d_name.name;
	int result = 0;
	struct {
		struct ima_digest_data hdr;
		char digest[IMA_MAX_DIGEST_SIZE];
	} hash;

	if (xattr_value)
		*xattr_len = ima_read_xattr(file->f_dentry, xattr_value);

	if (!(iint->flags & IMA_COLLECTED)) {
		u64 i_version = file_inode(file)->i_version;

		/* use default hash algorithm */
		hash.hdr.algo = ima_hash_algo;

		if (xattr_value)
			ima_get_hash_algo(*xattr_value, *xattr_len, &hash.hdr);

		result = ima_calc_file_hash(file, &hash.hdr);
		if (!result) {
			int length = sizeof(hash.hdr) + hash.hdr.length;
			void *tmpbuf = krealloc(iint->ima_hash, length,
						GFP_NOFS);
			if (tmpbuf) {
				iint->ima_hash = tmpbuf;
				memcpy(iint->ima_hash, &hash, length);
				iint->version = i_version;
				iint->flags |= IMA_COLLECTED;
			} else
				result = -ENOMEM;
		}
	}
	if (result)
		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
				    filename, "collect_data", "failed",
				    result, 0);
	return result;
}

/*
 * ima_store_measurement - store file measurement
 *
 * Create an "ima" template and then store the template by calling
 * ima_store_template.
 *
 * We only get here if the inode has not already been measured,
 * but the measurement could already exist:
 * 	- multiple copies of the same file on either the same or
 *	  different filesystems.
 *	- the inode was previously flushed as well as the iint info,
 *	  containing the hashing info.
 *
 * Must be called with iint->mutex held.
 */
void ima_store_measurement(struct integrity_iint_cache *iint,
			   struct file *file, const unsigned char *filename,
			   struct evm_ima_xattr_data *xattr_value,
			   int xattr_len)
{
	const char *op = "add_template_measure";
	const char *audit_cause = "ENOMEM";
	int result = -ENOMEM;
	struct inode *inode = file_inode(file);
	struct ima_template_entry *entry;
	int violation = 0;

	if (iint->flags & IMA_MEASURED)
		return;

	result = ima_alloc_init_template(iint, file, filename,
					 xattr_value, xattr_len, &entry);
	if (result < 0) {
		integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
				    op, audit_cause, result, 0);
		return;
	}

	result = ima_store_template(entry, violation, inode, filename);
	if (!result || result == -EEXIST)
		iint->flags |= IMA_MEASURED;
	if (result < 0)
		ima_free_template_entry(entry);
}

void ima_audit_measurement(struct integrity_iint_cache *iint,
			   const unsigned char *filename)
{
	struct audit_buffer *ab;
	char hash[(iint->ima_hash->length * 2) + 1];
	const char *algo_name = hash_algo_name[iint->ima_hash->algo];
	char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
	int i;

	if (iint->flags & IMA_AUDITED)
		return;

	for (i = 0; i < iint->ima_hash->length; i++)
		hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
	hash[i * 2] = '\0';

	ab = audit_log_start(current->audit_context, GFP_KERNEL,
			     AUDIT_INTEGRITY_RULE);
	if (!ab)
		return;

	audit_log_format(ab, "file=");
	audit_log_untrustedstring(ab, filename);
	audit_log_format(ab, " hash=");
	snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
	audit_log_untrustedstring(ab, algo_hash);

	audit_log_task_info(ab, current);
	audit_log_end(ab);

	iint->flags |= IMA_AUDITED;
}

const char *ima_d_path(struct path *path, char **pathbuf)
{
	char *pathname = NULL;

	/* We will allow 11 spaces for ' (deleted)' to be appended */
	*pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL);
	if (*pathbuf) {
		pathname = d_path(path, *pathbuf, PATH_MAX + 11);
		if (IS_ERR(pathname)) {
			kfree(*pathbuf);
			*pathbuf = NULL;
			pathname = NULL;
		}
	}
	return pathname;
}
Commit	Line	Data
3323eec9 MZ	1	/*
	2	* Copyright (C) 2008 IBM Corporation
	3	*
	4	* Author: Mimi Zohar <zohar@us.ibm.com>
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License as
	8	* published by the Free Software Foundation, version 2 of the
	9	* License.
	10	*
	11	* File: ima_api.c
2fe5d6de MZ	12	* Implements must_appraise_or_measure, collect_measurement,
2fe5d6de MZ	13	* appraise_measurement, store_measurement and store_template.
3323eec9 MZ	14	*/
3323eec9 MZ	15	#include <linux/module.h>
5a0e3ad6	16	#include <linux/slab.h>
2fe5d6de MZ	17	#include <linux/file.h>
	18	#include <linux/fs.h>
	19	#include <linux/xattr.h>
	20	#include <linux/evm.h>
ea593993	21	#include <crypto/hash_info.h>
3323eec9	22	#include "ima.h"
2fe5d6de	23
a7ed7c60 RS	24	/*
	25	* ima_free_template_entry - free an existing template entry
	26	*/
	27	void ima_free_template_entry(struct ima_template_entry *entry)
	28	{
	29	int i;
	30
	31	for (i = 0; i < entry->template_desc->num_fields; i++)
	32	kfree(entry->template_data[i].data);
	33
	34	kfree(entry);
	35	}
	36
7bc5f447 RS	37	/*
	38	* ima_alloc_init_template - create and initialize a new template entry
	39	*/
	40	int ima_alloc_init_template(struct integrity_iint_cache *iint,
	41	struct file file, const unsigned char filename,
bcbc9b0c MZ	42	struct evm_ima_xattr_data *xattr_value,
bcbc9b0c MZ	43	int xattr_len, struct ima_template_entry **entry)
7bc5f447	44	{
a71dc65d RS	45	struct ima_template_desc *template_desc = ima_template_desc_current();
a71dc65d RS	46	int i, result = 0;
7bc5f447	47
a71dc65d RS	48	entry = kzalloc(sizeof(entry) + template_desc->num_fields
	49	sizeof(struct ima_field_data), GFP_NOFS);
	50	if (!*entry)
7bc5f447 RS	51	return -ENOMEM;
7bc5f447 RS	52
a7ed7c60	53	(*entry)->template_desc = template_desc;
a71dc65d RS	54	for (i = 0; i < template_desc->num_fields; i++) {
	55	struct ima_template_field *field = template_desc->fields[i];
	56	u32 len;
7bc5f447	57
a71dc65d	58	result = field->field_init(iint, file, filename,
bcbc9b0c	59	xattr_value, xattr_len,
a71dc65d RS	60	&((*entry)->template_data[i]));
	61	if (result != 0)
	62	goto out;
7bc5f447	63
a71dc65d RS	64	len = (*entry)->template_data[i].len;
	65	(*entry)->template_data_len += sizeof(len);
	66	(*entry)->template_data_len += len;
	67	}
7bc5f447	68	return 0;
a71dc65d	69	out:
a7ed7c60	70	ima_free_template_entry(*entry);
a71dc65d	71	*entry = NULL;
7bc5f447 RS	72	return result;
	73	}
	74
3323eec9 MZ	75	/*
	76	* ima_store_template - store ima template measurements
	77	*
	78	* Calculate the hash of a template entry, add the template entry
	79	* to an ordered list of measurement entries maintained inside the kernel,
	80	* and also update the aggregate integrity value (maintained inside the
	81	* configured TPM PCR) over the hashes of the current list of measurement
	82	* entries.
	83	*
	84	* Applications retrieve the current kernel-held measurement list through
	85	* the securityfs entries in /sys/kernel/security/ima. The signed aggregate
	86	* TPM PCR (called quote) can be retrieved using a TPM user space library
	87	* and is used to validate the measurement list.
	88	*
	89	* Returns 0 on success, error code otherwise
	90	*/
	91	int ima_store_template(struct ima_template_entry *entry,
9803d413 RS	92	int violation, struct inode *inode,
9803d413 RS	93	const unsigned char *filename)
3323eec9 MZ	94	{
	95	const char *op = "add_template_measure";
	96	const char *audit_cause = "hashing_error";
a71dc65d	97	char *template_name = entry->template_desc->name;
3323eec9	98	int result;
a35c3fb6 DK	99	struct {
a35c3fb6 DK	100	struct ima_digest_data hdr;
140d8022	101	char digest[TPM_DIGEST_SIZE];
a35c3fb6	102	} hash;
3323eec9	103
3323eec9	104	if (!violation) {
a71dc65d RS	105	int num_fields = entry->template_desc->num_fields;
a71dc65d RS	106
ea593993 DK	107	/* this function uses default algo */
ea593993 DK	108	hash.hdr.algo = HASH_ALGO_SHA1;
a71dc65d	109	result = ima_calc_field_array_hash(&entry->template_data[0],
b6f8f16f	110	entry->template_desc,
a71dc65d	111	num_fields, &hash.hdr);
3323eec9 MZ	112	if (result < 0) {
3323eec9 MZ	113	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
a71dc65d	114	template_name, op,
3323eec9 MZ	115	audit_cause, result, 0);
	116	return result;
	117	}
a35c3fb6	118	memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
3323eec9	119	}
9803d413	120	result = ima_add_template_entry(entry, violation, op, inode, filename);
3323eec9 MZ	121	return result;
	122	}
	123
	124	/*
	125	* ima_add_violation - add violation to measurement list.
	126	*
	127	* Violations are flagged in the measurement list with zero hash values.
	128	* By extending the PCR with 0xFF's instead of with zeroes, the PCR
	129	* value is invalidated.
	130	*/
7d802a22	131	void ima_add_violation(struct file file, const unsigned char filename,
3323eec9 MZ	132	const char op, const char cause)
	133	{
	134	struct ima_template_entry *entry;
31d4b761	135	struct inode *inode = file_inode(file);
3323eec9 MZ	136	int violation = 1;
	137	int result;
	138
	139	/* can overflow, only indicator */
	140	atomic_long_inc(&ima_htable.violations);
	141
bcbc9b0c MZ	142	result = ima_alloc_init_template(NULL, file, filename,
bcbc9b0c MZ	143	NULL, 0, &entry);
7bc5f447	144	if (result < 0) {
3323eec9 MZ	145	result = -ENOMEM;
	146	goto err_out;
	147	}
9803d413	148	result = ima_store_template(entry, violation, inode, filename);
3323eec9	149	if (result < 0)
a7ed7c60	150	ima_free_template_entry(entry);
3323eec9 MZ	151	err_out:
	152	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
	153	op, cause, result, 0);
	154	}
	155
	156	/**
d9d300cd	157	* ima_get_action - appraise & measure decision based on policy.
3323eec9 MZ	158	* @inode: pointer to inode to measure
3323eec9 MZ	159	* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
16cac49f	160	* @function: calling function (FILE_CHECK, BPRM_CHECK, MMAP_CHECK, MODULE_CHECK)
3323eec9 MZ	161	*
	162	* The policy is defined in terms of keypairs:
	163	* subj=, obj=, type=, func=, mask=, fsmagic=
	164	* subj,obj, and type: are LSM specific.
16cac49f	165	* func: FILE_CHECK \| BPRM_CHECK \| MMAP_CHECK \| MODULE_CHECK
3323eec9 MZ	166	* mask: contains the permission mask
	167	* fsmagic: hex value
	168	*
2fe5d6de MZ	169	* Returns IMA_MEASURE, IMA_APPRAISE mask.
	170	*
	171	*/
d9d300cd	172	int ima_get_action(struct inode *inode, int mask, int function)
3323eec9	173	{
e7c568e0	174	int flags = IMA_MEASURE \| IMA_AUDIT \| IMA_APPRAISE;
2fe5d6de MZ	175
	176	if (!ima_appraise)
	177	flags &= ~IMA_APPRAISE;
	178
	179	return ima_match_policy(inode, function, mask, flags);
	180	}
3323eec9	181
2fe5d6de MZ	182	int ima_must_measure(struct inode *inode, int mask, int function)
	183	{
	184	return ima_match_policy(inode, function, mask, IMA_MEASURE);
3323eec9 MZ	185	}
	186
	187	/*
	188	* ima_collect_measurement - collect file measurement
	189	*
	190	* Calculate the file hash, if it doesn't already exist,
	191	* storing the measurement and i_version in the iint.
	192	*
	193	* Must be called with iint->mutex held.
	194	*
	195	* Return 0 on success, error code otherwise
	196	*/
f381c272	197	int ima_collect_measurement(struct integrity_iint_cache *iint,
d3634d0f DK	198	struct file *file,
	199	struct evm_ima_xattr_data **xattr_value,
	200	int *xattr_len)
3323eec9	201	{
496ad9aa	202	struct inode *inode = file_inode(file);
2fe5d6de MZ	203	const char *filename = file->f_dentry->d_name.name;
2fe5d6de MZ	204	int result = 0;
a35c3fb6 DK	205	struct {
	206	struct ima_digest_data hdr;
	207	char digest[IMA_MAX_DIGEST_SIZE];
	208	} hash;
3323eec9	209
d3634d0f DK	210	if (xattr_value)
	211	*xattr_len = ima_read_xattr(file->f_dentry, xattr_value);
	212
2fe5d6de	213	if (!(iint->flags & IMA_COLLECTED)) {
496ad9aa	214	u64 i_version = file_inode(file)->i_version;
3323eec9	215
c7c8bb23	216	/* use default hash algorithm */
a35c3fb6	217	hash.hdr.algo = ima_hash_algo;
d3634d0f DK	218
d3634d0f DK	219	if (xattr_value)
a35c3fb6	220	ima_get_hash_algo(xattr_value, xattr_len, &hash.hdr);
d3634d0f	221
a35c3fb6	222	result = ima_calc_file_hash(file, &hash.hdr);
2fe5d6de	223	if (!result) {
a35c3fb6 DK	224	int length = sizeof(hash.hdr) + hash.hdr.length;
	225	void *tmpbuf = krealloc(iint->ima_hash, length,
	226	GFP_NOFS);
	227	if (tmpbuf) {
	228	iint->ima_hash = tmpbuf;
	229	memcpy(iint->ima_hash, &hash, length);
	230	iint->version = i_version;
	231	iint->flags \|= IMA_COLLECTED;
	232	} else
	233	result = -ENOMEM;
2fe5d6de	234	}
3323eec9	235	}
2fe5d6de MZ	236	if (result)
	237	integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
	238	filename, "collect_data", "failed",
	239	result, 0);
3323eec9 MZ	240	return result;
	241	}
	242
	243	/*
	244	* ima_store_measurement - store file measurement
	245	*
	246	* Create an "ima" template and then store the template by calling
	247	* ima_store_template.
	248	*
	249	* We only get here if the inode has not already been measured,
	250	* but the measurement could already exist:
	251	* - multiple copies of the same file on either the same or
	252	* different filesystems.
	253	* - the inode was previously flushed as well as the iint info,
	254	* containing the hashing info.
	255	*
	256	* Must be called with iint->mutex held.
	257	*/
f381c272	258	void ima_store_measurement(struct integrity_iint_cache *iint,
bcbc9b0c MZ	259	struct file file, const unsigned char filename,
	260	struct evm_ima_xattr_data *xattr_value,
	261	int xattr_len)
3323eec9 MZ	262	{
	263	const char *op = "add_template_measure";
	264	const char *audit_cause = "ENOMEM";
	265	int result = -ENOMEM;
496ad9aa	266	struct inode *inode = file_inode(file);
3323eec9 MZ	267	struct ima_template_entry *entry;
	268	int violation = 0;
	269
2fe5d6de MZ	270	if (iint->flags & IMA_MEASURED)
	271	return;
	272
bcbc9b0c MZ	273	result = ima_alloc_init_template(iint, file, filename,
bcbc9b0c MZ	274	xattr_value, xattr_len, &entry);
7bc5f447	275	if (result < 0) {
3323eec9 MZ	276	integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
	277	op, audit_cause, result, 0);
	278	return;
	279	}
3323eec9	280
9803d413	281	result = ima_store_template(entry, violation, inode, filename);
45fae749	282	if (!result \|\| result == -EEXIST)
3323eec9	283	iint->flags \|= IMA_MEASURED;
45fae749	284	if (result < 0)
a7ed7c60	285	ima_free_template_entry(entry);
3323eec9	286	}
e7c568e0 PM	287
	288	void ima_audit_measurement(struct integrity_iint_cache *iint,
	289	const unsigned char *filename)
	290	{
	291	struct audit_buffer *ab;
a35c3fb6	292	char hash[(iint->ima_hash->length * 2) + 1];
5278aa52 MZ	293	const char *algo_name = hash_algo_name[iint->ima_hash->algo];
5278aa52 MZ	294	char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
e7c568e0 PM	295	int i;
	296
	297	if (iint->flags & IMA_AUDITED)
	298	return;
	299
a35c3fb6 DK	300	for (i = 0; i < iint->ima_hash->length; i++)
a35c3fb6 DK	301	hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
e7c568e0 PM	302	hash[i * 2] = '\0';
	303
	304	ab = audit_log_start(current->audit_context, GFP_KERNEL,
	305	AUDIT_INTEGRITY_RULE);
	306	if (!ab)
	307	return;
	308
	309	audit_log_format(ab, "file=");
	310	audit_log_untrustedstring(ab, filename);
	311	audit_log_format(ab, " hash=");
5278aa52 MZ	312	snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
5278aa52 MZ	313	audit_log_untrustedstring(ab, algo_hash);
e7c568e0 PM	314
	315	audit_log_task_info(ab, current);
	316	audit_log_end(ab);
	317
	318	iint->flags \|= IMA_AUDITED;
	319	}
ea1046d4 DK	320
	321	const char ima_d_path(struct path path, char **pathbuf)
	322	{
	323	char *pathname = NULL;
	324
	325	/* We will allow 11 spaces for ' (deleted)' to be appended */
	326	*pathbuf = kmalloc(PATH_MAX + 11, GFP_KERNEL);
	327	if (*pathbuf) {
	328	pathname = d_path(path, *pathbuf, PATH_MAX + 11);
	329	if (IS_ERR(pathname)) {
	330	kfree(*pathbuf);
	331	*pathbuf = NULL;
	332	pathname = NULL;
	333	}
	334	}
	335	return pathname;
	336	}