Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Lakshmi Ramasubramanian
On 6/9/20 10:35 AM, Steve Grubb wrote: If it is added, it should be appended to the end of the record since it is an existing record format, then in the case of res=1, errno= should still be present (not swing in and out) and just contain zero. (Or another value if there is a non-fatal warning?

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Steve Grubb
On Tuesday, June 9, 2020 1:15:55 PM EDT Richard Guy Briggs wrote: > On 2020-06-09 10:00, Lakshmi Ramasubramanian wrote: > > On 6/9/20 9:43 AM, Steve Grubb wrote: > > > > The number in parenthesis is the error code (such as ENOMEM, EINVAL, > > > > etc.) IMA uses this format for reporting TPM errors

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Mimi Zohar
Hi Richard, On Tue, 2020-06-09 at 13:15 -0400, Richard Guy Briggs wrote: > On 2020-06-09 10:00, Lakshmi Ramasubramanian wrote: > If it is added, it should be appended to the end of the record since it > is an existing record format, then in the case of res=1, errno= should > still be present (not

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Richard Guy Briggs
On 2020-06-09 10:00, Lakshmi Ramasubramanian wrote: > On 6/9/20 9:43 AM, Steve Grubb wrote: > > > > The number in parenthesis is the error code (such as ENOMEM, EINVAL, > > > etc.) IMA uses this format for reporting TPM errors in one of the audit > > > messages (In ima_add_template_entry()). I fol

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Mimi Zohar
On Tue, 2020-06-09 at 10:00 -0700, Lakshmi Ramasubramanian wrote: > On 6/9/20 9:43 AM, Steve Grubb wrote: > > >> The number in parenthesis is the error code (such as ENOMEM, EINVAL, > >> etc.) IMA uses this format for reporting TPM errors in one of the audit > >> messages (In ima_add_template_entr

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Mimi Zohar
On Mon, 2020-06-08 at 14:53 -0700, Lakshmi Ramasubramanian wrote: > The final log statement in process_buffer_measurement() for failure > condition is at debug level. This does not log the message unless > the system log level is raised which would significantly increase > the messages in the syste

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Lakshmi Ramasubramanian
On 6/9/20 9:43 AM, Steve Grubb wrote: The number in parenthesis is the error code (such as ENOMEM, EINVAL, etc.) IMA uses this format for reporting TPM errors in one of the audit messages (In ima_add_template_entry()). I followed the same pattern. Would it be better if the value for "cause" is

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Steve Grubb
Hello, On Tuesday, June 9, 2020 11:58:02 AM EDT Lakshmi Ramasubramanian wrote: > On 6/9/20 8:40 AM, Steve Grubb wrote: > > On Monday, June 8, 2020 5:53:43 PM EDT Lakshmi Ramasubramanian wrote: > >> The final log statement in process_buffer_measurement() for failure > >> condition is at debug level

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Lakshmi Ramasubramanian
On 6/9/20 8:40 AM, Steve Grubb wrote: On Monday, June 8, 2020 5:53:43 PM EDT Lakshmi Ramasubramanian wrote: The final log statement in process_buffer_measurement() for failure condition is at debug level. This does not log the message unless the system log level is raised which would significan

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Steve Grubb
On Monday, June 8, 2020 5:53:43 PM EDT Lakshmi Ramasubramanian wrote: > The final log statement in process_buffer_measurement() for failure > condition is at debug level. This does not log the message unless > the system log level is raised which would significantly increase > the messages in the s

Re: [PATCH v3] IMA: Add audit log for failure conditions

2020-06-09 Thread Richard Guy Briggs
On 2020-06-08 14:53, Lakshmi Ramasubramanian wrote: > The final log statement in process_buffer_measurement() for failure > condition is at debug level. This does not log the message unless > the system log level is raised which would significantly increase > the messages in the system log. Change

[PATCH v3] IMA: Add audit log for failure conditions

2020-06-08 Thread Lakshmi Ramasubramanian
The final log statement in process_buffer_measurement() for failure condition is at debug level. This does not log the message unless the system log level is raised which would significantly increase the messages in the system log. Change this log message to an audit message for better triaging fai