Re: [PATCH 8/8] ima: Differentiate auditing policy rules from "audit" actions

[Stefan Berger <stefanb@linux.vnet.ibm.com>]

[-- Attachment #1.1: Type: text/plain, Size: 4344 bytes --]

On 05/29/2018 05:30 PM, Steve Grubb wrote:
> Hello,
>
>
> On Thursday, May 24, 2018 4:11:05 PM EDT Stefan Berger wrote:
>> The AUDIT_INTEGRITY_RULE is used for auditing IMA policy rules and
>> the IMA "audit" policy action.  This patch defines
>> AUDIT_INTEGRITY_POLICY_RULE to reflect the IMA policy rules.
>>
>> With this change we now call integrity_audit_msg_common() to get
>> common integrity auditing fields. This now produces the following
>> record when parsing an IMA policy rule:
>>
>> type=UNKNOWN[1806] msg=audit(1527004216.690:311): action=dont_measure \
>>    fsmagic=0x9fa0 pid=1613 uid=0 auid=0 ses=2 \
>>    subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 \
>>    op=policy_update cause=parse_rule comm="echo" exe="/usr/bin/echo" \
>>    tty=tty2 res=1
> Since this is a new event, do you mind moving the tty field to be between
> auid= and ses=  ?   That is the more natural place for it.

6/8 refactors the code so that the integrity audit records produced by 
IMA follow one format in terms of ordering of the fields, with fields 
like inode optional, though, and AUDIT_INTEGRITY_RULE in the end being 
the only one with a different format. Do we really want to change that 
order just for 1806?

5/8 now produces the following:

type=INTEGRITY_PCR msg=audit(1527685075.941:502): pid=2431 \
   uid=0 auid=1000 ses=5 \
   subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 \
   op=invalid_pcr cause=open_writers comm="grep" \
   name="/var/log/audit/audit.log" dev="dm-0" ino=1962494 \
   exe="/usr/bin/grep" tty=pts0 res=1

Comparing the two:

1806:          action, fsmagic, pid, uid, auid, ses, subj, op, cause, 
comm,    exe, tty, res
INTEGRITY_PCR:                  pid, uid, auid, ses, subj, op, cause, 
comm, name, dev, ino, exe, tty, res

> Also, it might be more natural for the op= and cause= fields to be before the
> pid= portion. This doesn't matter as much to me because those are not
> searchable fields and they are skipped right over. But moving the tty field
> is the main comment from me.

With the refactoring in 6/8 we at least have consistency among the 
INTEGRITY_* records, with the only exception being AUDIT_INTEGRITY_RULE 
that has its own format:

https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_api.c#L324

The other ones currently all format using integrity_audit_msg().

>
> Thanks,
> -Steve
>
>> Signed-off-by: Stefan Berger<stefanb@linux.vnet.ibm.com>
>> ---
>>   include/uapi/linux/audit.h          | 3 ++-
>>   security/integrity/ima/ima_policy.c | 5 +++--
>>   2 files changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
>> index 4e61a9e05132..776e0abd35cf 100644
>> --- a/include/uapi/linux/audit.h
>> +++ b/include/uapi/linux/audit.h
>> @@ -146,7 +146,8 @@
>>   #define AUDIT_INTEGRITY_STATUS	    1802 /* Integrity enable status */
>>   #define AUDIT_INTEGRITY_HASH	    1803 /* Integrity HASH type */
>>   #define AUDIT_INTEGRITY_PCR	    1804 /* PCR invalidation msgs */
>> -#define AUDIT_INTEGRITY_RULE	    1805 /* policy rule */
>> +#define AUDIT_INTEGRITY_RULE	    1805 /* IMA "audit" action policy msgs
>> */ +#define AUDIT_INTEGRITY_POLICY_RULE 1806 /* IMA policy rules */
>>
>>   #define AUDIT_KERNEL		2000	/* Asynchronous audit record. NOT A
> REQUEST. */
>> diff --git a/security/integrity/ima/ima_policy.c
>> b/security/integrity/ima/ima_policy.c index 3aed25a7178a..a8ae47a386b4
>> 100644
>> --- a/security/integrity/ima/ima_policy.c
>> +++ b/security/integrity/ima/ima_policy.c
>> @@ -634,7 +634,7 @@ static int ima_parse_rule(char *rule, struct
>> ima_rule_entry *entry) int result = 0;
>>
>>   	ab = integrity_audit_log_start(NULL, GFP_KERNEL,
>> -				       AUDIT_INTEGRITY_RULE);
>> +				       AUDIT_INTEGRITY_POLICY_RULE);
>>
>>   	entry->uid = INVALID_UID;
>>   	entry->fowner = INVALID_UID;
>> @@ -926,7 +926,8 @@ static int ima_parse_rule(char *rule, struct
>> ima_rule_entry *entry) temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
>>   	else if (entry->func == POLICY_CHECK)
>>   		temp_ima_appraise |= IMA_APPRAISE_POLICY;
>> -	audit_log_format(ab, "res=%d", !result);
>> +	integrity_audit_msg_common(ab, NULL, NULL,
>> +				   "policy_update", "parse_rule", result);
>>   	audit_log_end(ab);
>>   	return result;
>>   }
>
>


[-- Attachment #1.2: Type: text/html, Size: 5524 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]