From patchwork Sun Jun 7 22:14:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lakshmi Ramasubramanian X-Patchwork-Id: 11592315 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 74FDE60D for ; Sun, 7 Jun 2020 22:14:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3DA022073B for ; Sun, 7 Jun 2020 22:14:55 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="ksQIBClc" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727778AbgFGWOy (ORCPT ); Sun, 7 Jun 2020 18:14:54 -0400 Received: from linux.microsoft.com ([13.77.154.182]:37138 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726914AbgFGWOy (ORCPT ); Sun, 7 Jun 2020 18:14:54 -0400 Received: from localhost.localdomain (c-73-42-176-67.hsd1.wa.comcast.net [73.42.176.67]) by linux.microsoft.com (Postfix) with ESMTPSA id 9A53120B717B; Sun, 7 Jun 2020 15:14:53 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 9A53120B717B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1591568093; bh=vKUmF5ckc5noeScP5nZD6PTvqmgHQO548me51C7mGOc=; h=From:To:Cc:Subject:Date:From; b=ksQIBClcm+fvcIU4j6HV5kiXX/qLwiGN0d1fapqhM+tJRCqyRN+effncwsA+baZVf zVNyKZOFy4XSjHo/LeZJYDNJCBRY1vMG6hNxePN8f0K2DvAa9Hie1DT+zNdbMbqnG8 +TnMR3v0aF8B3DQgEa/q0OrXlsRZ7yH2cw2zPGOc= From: Lakshmi Ramasubramanian To: zohar@linux.ibm.com, paul@paul-moore.com Cc: linux-integrity@vger.kernel.org, linux-audit@redhat.com, linux-kernel@vger.kernel.org Subject: [PATCH v2] IMA: Add audit log for failure conditions Date: Sun, 7 Jun 2020 15:14:49 -0700 Message-Id: <20200607221449.2837-1-nramas@linux.microsoft.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The final log statement in process_buffer_measurement() for failure condition is at debug level. This does not log the message unless the system log level is raised which would significantly increase the messages in the system log. Change this log message to an audit message for better triaging failures in the function. ima_alloc_key_entry() does not log a message for failure condition. Add an audit message for failure condition in this function. Signed-off-by: Lakshmi Ramasubramanian --- security/integrity/ima/ima_main.c | 17 ++++++++++++----- security/integrity/ima/ima_queue_keys.c | 4 ++++ 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 800fb3bba418..1225198fceb1 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -739,6 +739,7 @@ void process_buffer_measurement(const void *buf, int size, int pcr, const char *keyring) { int ret = 0; + const char *audit_cause = "ENOMEM"; struct ima_template_entry *entry = NULL; struct integrity_iint_cache iint = {}; struct ima_event_data event_data = {.iint = &iint, @@ -793,21 +794,27 @@ void process_buffer_measurement(const void *buf, int size, iint.ima_hash->length = hash_digest_size[ima_hash_algo]; ret = ima_calc_buffer_hash(buf, size, iint.ima_hash); - if (ret < 0) + if (ret < 0) { + audit_cause = "calc_buffer_hash"; goto out; + } ret = ima_alloc_init_template(&event_data, &entry, template); - if (ret < 0) + if (ret < 0) { + audit_cause = "alloc_init_template"; goto out; + } ret = ima_store_template(entry, violation, NULL, buf, pcr); - - if (ret < 0) + if (ret < 0) { + audit_cause = "store_template"; ima_free_template_entry(entry); + } out: if (ret < 0) - pr_devel("%s: failed, result: %d\n", __func__, ret); + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, eventname, + __func__, audit_cause, ret, 0); return; } diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c index cb3e3f501593..fa606ce68f87 100644 --- a/security/integrity/ima/ima_queue_keys.c +++ b/security/integrity/ima/ima_queue_keys.c @@ -68,6 +68,7 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring, size_t payload_len) { int rc = 0; + const char *audit_cause = "ENOMEM"; struct ima_key_entry *entry; entry = kzalloc(sizeof(*entry), GFP_KERNEL); @@ -88,6 +89,9 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring, out: if (rc) { + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, + keyring->description, __func__, + audit_cause, rc, 0); ima_free_key_entry(entry); entry = NULL; }