Commit 523979ad authored by Mimi Zohar's avatar Mimi Zohar Committed by James Morris
Browse files

integrity: audit update 

Based on discussions on linux-audit, as per Steve Grubb's request
http://lkml.org/lkml/2009/2/6/269

, the following changes were made:
- forced audit result to be either 0 or 1.
- made template names const
- Added new stand-alone message type: AUDIT_INTEGRITY_RULE

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Acked-by: default avatarSteve Grubb <sgrubb@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent ed850a52

include/linux/audit.h

+3 −1
Original line number Diff line number Diff line
@@ -36,7 +36,8 @@ 
 * 1500 - 1599 kernel LSPP events

 * 1600 - 1699 kernel crypto events

 * 1700 - 1799 kernel anomaly records

 * 1800 - 1999 future kernel use (maybe integrity labels and related events)

 * 1800 - 1899 kernel integrity events

 * 1900 - 1999 future kernel use

 * 2000 is for otherwise unclassified kernel audit messages (legacy)

 * 2001 - 2099 unused (kernel)

 * 2100 - 2199 user space anomaly records
@@ -130,6 +131,7 @@ 
#define AUDIT_INTEGRITY_STATUS	    1802 /* Integrity enable status */

#define AUDIT_INTEGRITY_HASH	    1803 /* Integrity HASH type */

#define AUDIT_INTEGRITY_PCR	    1804 /* PCR invalidation msgs */

#define AUDIT_INTEGRITY_RULE	    1805 /* policy rule */



#define AUDIT_KERNEL		2000	/* Asynchronous audit record. NOT A REQUEST. */

security/integrity/ima/ima.h

+1 −1
Original line number Diff line number Diff line
@@ -47,7 +47,7 @@ struct ima_template_data { 


struct ima_template_entry {

	u8 digest[IMA_DIGEST_SIZE];	/* sha1 or md5 measurement hash */

	char *template_name;

	const char *template_name;

	int template_len;

	struct ima_template_data template;

};

security/integrity/ima/ima_api.c

+1 −1
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ 
#include <linux/module.h>



#include "ima.h"

static char *IMA_TEMPLATE_NAME = "ima";

static const char *IMA_TEMPLATE_NAME = "ima";



/*

 * ima_store_template - store ima template measurements

security/integrity/ima/ima_audit.c

+12 −9
Original line number Diff line number Diff line
@@ -22,16 +22,18 @@ static int ima_audit; 
static int __init ima_audit_setup(char *str)

{

	unsigned long audit;

	int rc;

	char *op;

	int rc, result = 0;

	char *op = "ima_audit";

	char *cause;



	rc = strict_strtoul(str, 0, &audit);

	if (rc || audit > 1)

		printk(KERN_INFO "ima: invalid ima_audit value\n");

		result = 1;

	else

		ima_audit = audit;

	op = ima_audit ? "ima_audit_enabled" : "ima_audit_not_enabled";

	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, NULL, op, 0, 0);

	cause = ima_audit ? "enabled" : "not_enabled";

	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,

			    op, cause, result, 0);

	return 1;

}

__setup("ima_audit=", ima_audit_setup);
@@ -47,20 +49,21 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode, 
		return;



	ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);

	audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u",

	audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u ses=%u",

			 current->pid, current->cred->uid,

			 audit_get_loginuid(current));

			 audit_get_loginuid(current),

			 audit_get_sessionid(current));

	audit_log_task_context(ab);

	switch (audit_msgno) {

	case AUDIT_INTEGRITY_DATA:

	case AUDIT_INTEGRITY_METADATA:

	case AUDIT_INTEGRITY_PCR:

	case AUDIT_INTEGRITY_STATUS:

		audit_log_format(ab, " op=%s cause=%s", op, cause);

		break;

	case AUDIT_INTEGRITY_HASH:

		audit_log_format(ab, " op=%s hash=%s", op, cause);

		break;

	case AUDIT_INTEGRITY_STATUS:

	default:

		audit_log_format(ab, " op=%s", op);

	}
@@ -73,6 +76,6 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode, 
	if (inode)

		audit_log_format(ab, " dev=%s ino=%lu",

				 inode->i_sb->s_id, inode->i_ino);

	audit_log_format(ab, " res=%d", result);

	audit_log_format(ab, " res=%d", !result ? 0 : 1);

	audit_log_end(ab);

}

security/integrity/ima/ima_fs.c

+1 −1
Original line number Diff line number Diff line
@@ -137,7 +137,7 @@ static int ima_measurements_show(struct seq_file *m, void *v) 
	ima_putc(m, &namelen, sizeof namelen);



	/* 4th:  template name */

	ima_putc(m, e->template_name, namelen);

	ima_putc(m, (void *)e->template_name, namelen);



	/* 5th:  template specific data */

	ima_template_show(m, (struct ima_template_data *)&e->template,

CRA Git | Maintained and supported by SUSTech CRA and CCSE