search

CamFlow / camflow-dev

Generates kernel patch for CamFlow Linux Provenance Capture.
http://camflow.org/
GNU General Public License v2.0
26 stars 15 forks source link

CamFlow's Bookkeeping for Inode Security Field Should Not Result in Provenance Graph #88

Closed michael-hahn closed 5 years ago

michael-hahn commented 5 years ago

provenance_inode_alloc_security hook is for setting up CamFlow's security bookkeeping, which should not result in any provenance subgraph.

tfjmp commented 5 years ago

https://github.com/CamFlow/camflow-dev/commit/4ff112fb72899bfe9f0a8847aec1743d872c53dd should fix the issue.

@michael-hahn please double check that it is ok and close.

michael-hahn commented 5 years ago

provenance_inode_alloc_security() in hook.c calls refresh_inode_provenance() function, which calls update_inode_type() function in provenance_inode.h. This function can possibly call __write_relation(RL_VERSION, &old_prov, prov_elt(prov), NULL, 0); which will create an edge. This issue remains.

tfjmp commented 5 years ago

Should be fixed in https://github.com/CamFlow/camflow-dev/compare/30dc0ca81602...38c7715a32f8

@michael-hahn close if good now.

michael-hahn commented 5 years ago

TinkerBell confirms that provenance_inode_alloc_security is empty. Close this issue for now.