evm: audit integrity metadata failures
authorMimi Zohar <zohar@linux.vnet.ibm.com>
Thu, 21 Feb 2013 14:31:22 +0000 (09:31 -0500)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Thu, 20 Jun 2013 11:47:50 +0000 (07:47 -0400)
Before modifying an EVM protected extended attribute or any other
metadata included in the HMAC calculation, the existing 'security.evm'
is verified.  This patch adds calls to integrity_audit_msg() to audit
integrity metadata failures.

Reported-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
security/integrity/evm/evm_main.c

index cdbde17..df0fa45 100644 (file)
@@ -16,6 +16,7 @@
 
 #include <linux/module.h>
 #include <linux/crypto.h>
+#include <linux/audit.h>
 #include <linux/xattr.h>
 #include <linux/integrity.h>
 #include <linux/evm.h>
@@ -24,6 +25,9 @@
 
 int evm_initialized;
 
+static char *integrity_status_msg[] = {
+       "pass", "fail", "no_label", "no_xattrs", "unknown"
+};
 char *evm_hmac = "hmac(sha1)";
 char *evm_hash = "sha1";
 int evm_hmac_version = CONFIG_EVM_HMAC_VERSION;
@@ -262,9 +266,15 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
                if ((evm_status == INTEGRITY_PASS) ||
                    (evm_status == INTEGRITY_NOXATTRS))
                        return 0;
-               return -EPERM;
+               goto out;
        }
        evm_status = evm_verify_current_integrity(dentry);
+out:
+       if (evm_status != INTEGRITY_PASS)
+               integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
+                                   dentry->d_name.name, "appraise_metadata",
+                                   integrity_status_msg[evm_status],
+                                   -EPERM, 0);
        return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
 }
 
@@ -357,6 +367,9 @@ int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
        if ((evm_status == INTEGRITY_PASS) ||
            (evm_status == INTEGRITY_NOXATTRS))
                return 0;
+       integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode,
+                           dentry->d_name.name, "appraise_metadata",
+                           integrity_status_msg[evm_status], -EPERM, 0);
        return -EPERM;
 }