All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] IMA: Updated KBUILD_MODNAME for IMA files to ima
@ 2020-02-07 19:53 Tushar Sugandhi
  2020-02-07 19:53 ` [PATCH] IMA: Add log statements for failure conditions Tushar Sugandhi
  0 siblings, 1 reply; 23+ messages in thread
From: Tushar Sugandhi @ 2020-02-07 19:53 UTC (permalink / raw)
  To: zohar, linux-integrity; +Cc: sashal, nramas, linux-kernel

Log statements from ima_mok.c, ima_asymmetric_keys.c, and
ima_queue_keys.c are prefixed with the respective file names
and not with the string "ima". 

This change fixes the log statement prefix to be consistent with the rest
of the IMA files.

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
 security/integrity/ima/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index 064a256f8725..67dabca670e2 100644
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -11,6 +11,6 @@ ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
 ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
 ima-$(CONFIG_IMA_APPRAISE_MODSIG) += ima_modsig.o
 ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o
-obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
-obj-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o
-obj-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o
+ima-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
+ima-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o
+ima-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 23+ messages in thread
* [PATCH] IMA: Add log statements for failure conditions.
  2020-02-07 19:53 [PATCH] IMA: Updated KBUILD_MODNAME for IMA files to ima Tushar Sugandhi
@ 2020-02-07 19:53 ` Tushar Sugandhi
  2020-02-09 12:57   ` Mimi Zohar
  0 siblings, 1 reply; 23+ messages in thread
From: Tushar Sugandhi @ 2020-02-07 19:53 UTC (permalink / raw)
  To: zohar, linux-integrity; +Cc: sashal, nramas, linux-kernel

process_buffer_measurement() and ima_alloc_key_entry()
functions do not have log messages for failure conditions.

This change adds log statements in the above functions. 

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
 security/integrity/ima/ima_main.c       | 4 ++++
 security/integrity/ima/ima_queue_keys.c | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 9fe949c6a530..afab796fb765 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -757,6 +757,10 @@ void process_buffer_measurement(const void *buf, int size,
 		ima_free_template_entry(entry);
 
 out:
+	if (ret < 0)
+		pr_err("Process buffer measurement failed, result: %d\n",
+			ret);
+
 	return;
 }
 
diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
index c87c72299191..2cc52f17ea81 100644
--- a/security/integrity/ima/ima_queue_keys.c
+++ b/security/integrity/ima/ima_queue_keys.c
@@ -90,6 +90,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
 
 out:
 	if (rc) {
+		pr_err("Key entry allocation failed, result: %d\n",
+			rc);
 		ima_free_key_entry(entry);
 		entry = NULL;
 	}
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-07 19:53 ` [PATCH] IMA: Add log statements for failure conditions Tushar Sugandhi
@ 2020-02-09 12:57   ` Mimi Zohar
  2020-02-10  2:46     ` Joe Perches
  0 siblings, 1 reply; 23+ messages in thread
From: Mimi Zohar @ 2020-02-09 12:57 UTC (permalink / raw)
  To: Tushar Sugandhi, linux-integrity
  Cc: sashal, nramas, linux-kernel, Joe Perches

Hi Tushar,

On Fri, 2020-02-07 at 11:53 -0800, Tushar Sugandhi wrote:
> process_buffer_measurement() and ima_alloc_key_entry()
> functions do not have log messages for failure conditions.
> 
> This change adds log statements in the above functions. 
> 
> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
> Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>

The two patches you posted are related.  Please group them as a patch
set, making this patch 2/2.

In addition, as Shuah Khan suggested for the security/integrity/
directory, "there is an opportunity here to add #define pr_fmt(fmt)
KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
defines."  With Joe Perches patch (waiting for it to be re-posted),
are all the pr_fmt definitions needed in each file in the
integrity/ima directory?

> ---
>  security/integrity/ima/ima_main.c       | 4 ++++
>  security/integrity/ima/ima_queue_keys.c | 2 ++
>  2 files changed, 6 insertions(+)
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 9fe949c6a530..afab796fb765 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -757,6 +757,10 @@ void process_buffer_measurement(const void *buf, int size,
>  		ima_free_template_entry(entry);
>  
>  out:
> +	if (ret < 0)
> +		pr_err("Process buffer measurement failed, result: %d\n",
> +			ret);

There's no reason to split the statement like this.  The joined line
is less than 80 characters.

> +
>  	return;
>  }
>  
> diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
> index c87c72299191..2cc52f17ea81 100644
> --- a/security/integrity/ima/ima_queue_keys.c
> +++ b/security/integrity/ima/ima_queue_keys.c
> @@ -90,6 +90,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
>  
>  out:
>  	if (rc) {
> +		pr_err("Key entry allocation failed, result: %d\n",
> +			rc);

ditto

>  		ima_free_key_entry(entry);
>  		entry = NULL;
>  	}

thanks,

Mimi


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-09 12:57   ` Mimi Zohar
@ 2020-02-10  2:46     ` Joe Perches
  2020-02-10 16:40       ` Lakshmi Ramasubramanian
  0 siblings, 1 reply; 23+ messages in thread
From: Joe Perches @ 2020-02-10  2:46 UTC (permalink / raw)
  To: Mimi Zohar, Tushar Sugandhi, linux-integrity; +Cc: sashal, nramas, linux-kernel

On Sun, 2020-02-09 at 07:57 -0500, Mimi Zohar wrote:
> Hi Tushar,
> 
> On Fri, 2020-02-07 at 11:53 -0800, Tushar Sugandhi wrote:
> > process_buffer_measurement() and ima_alloc_key_entry()
> > functions do not have log messages for failure conditions.
> > 
> > This change adds log statements in the above functions. 
> > 
> > Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
> > Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
> 
> The two patches you posted are related.  Please group them as a patch
> set, making this patch 2/2.
> 
> In addition, as Shuah Khan suggested for the security/integrity/
> directory, "there is an opportunity here to add #define pr_fmt(fmt)
> KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
> defines."  With Joe Perches patch (waiting for it to be re-posted),
> are all the pr_fmt definitions needed in each file in the
> integrity/ima directory?

btw Tushar and Lakshmi:

I am not formally submitting a patch here.

I was just making suggestions and please do
with it as you think appropriate.

and welcome, cheers, Joe

> > ---
> >  security/integrity/ima/ima_main.c       | 4 ++++
> >  security/integrity/ima/ima_queue_keys.c | 2 ++
> >  2 files changed, 6 insertions(+)
> > 
> > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > index 9fe949c6a530..afab796fb765 100644
> > --- a/security/integrity/ima/ima_main.c
> > +++ b/security/integrity/ima/ima_main.c
> > @@ -757,6 +757,10 @@ void process_buffer_measurement(const void *buf, int size,
> >  		ima_free_template_entry(entry);
> >  
> >  out:
> > +	if (ret < 0)
> > +		pr_err("Process buffer measurement failed, result: %d\n",
> > +			ret);
> 
> There's no reason to split the statement like this.  The joined line
> is less than 80 characters.
> 
> > +
> >  	return;
> >  }
> >  
> > diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
> > index c87c72299191..2cc52f17ea81 100644
> > --- a/security/integrity/ima/ima_queue_keys.c
> > +++ b/security/integrity/ima/ima_queue_keys.c
> > @@ -90,6 +90,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
> >  
> >  out:
> >  	if (rc) {
> > +		pr_err("Key entry allocation failed, result: %d\n",
> > +			rc);
> 
> ditto
> 
> >  		ima_free_key_entry(entry);
> >  		entry = NULL;
> >  	}
> 
> thanks,
> 
> Mimi
> 


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-10  2:46     ` Joe Perches
@ 2020-02-10 16:40       ` Lakshmi Ramasubramanian
  2020-02-10 16:50         ` Joe Perches
  0 siblings, 1 reply; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-02-10 16:40 UTC (permalink / raw)
  To: Joe Perches, Mimi Zohar, Tushar Sugandhi, linux-integrity
  Cc: sashal, linux-kernel

On 2/9/20 6:46 PM, Joe Perches wrote:

>>
>> In addition, as Shuah Khan suggested for the security/integrity/
>> directory, "there is an opportunity here to add #define pr_fmt(fmt)
>> KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
>> defines."  

Good point - we'll make that change.

With Joe Perches patch (waiting for it to be re-posted),
>> are all the pr_fmt definitions needed in each file in the
>> integrity/ima directory?
> 
> btw Tushar and Lakshmi:
> 
> I am not formally submitting a patch here.
> 
> I was just making suggestions and please do
> with it as you think appropriate.

Joe - it's not clear to me what you are suggesting.
We'll move the #define for pr_fmt to integrity.h.

What's other changes are you proposing?

>>>   
>>>   out:
>>> +	if (ret < 0)
>>> +		pr_err("Process buffer measurement failed, result: %d\n",
>>> +			ret);
>>
>> There's no reason to split the statement like this.  The joined line
>> is less than 80 characters.

Agree.

thanks,
  -lakshmi

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-10 16:40       ` Lakshmi Ramasubramanian
@ 2020-02-10 16:50         ` Joe Perches
  2020-02-10 21:42           ` Tushar Sugandhi
       [not found]           ` <0c9099b5-da29-3e71-0933-123dfe08442c@linux.microsoft.com>
  0 siblings, 2 replies; 23+ messages in thread
From: Joe Perches @ 2020-02-10 16:50 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian, Mimi Zohar, Tushar Sugandhi, linux-integrity
  Cc: sashal, linux-kernel

On Mon, 2020-02-10 at 08:40 -0800, Lakshmi Ramasubramanian wrote:
> On 2/9/20 6:46 PM, Joe Perches wrote:
> 
> > > In addition, as Shuah Khan suggested for the security/integrity/
> > > directory, "there is an opportunity here to add #define pr_fmt(fmt)
> > > KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
> > > defines."  
> 
> Good point - we'll make that change.
> 
> With Joe Perches patch (waiting for it to be re-posted),
> > > are all the pr_fmt definitions needed in each file in the
> > > integrity/ima directory?
> > 
> > btw Tushar and Lakshmi:
> > 
> > I am not formally submitting a patch here.
> > 
> > I was just making suggestions and please do
> > with it as you think appropriate.
> 
> Joe - it's not clear to me what you are suggesting.
> We'll move the #define for pr_fmt to integrity.h.
> 
> What's other changes are you proposing?

https://lore.kernel.org/lkml/4b4ee302f2f97e3907ab03e55a92ccd46b6cf171.camel@perches.com/



^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-10 16:50         ` Joe Perches
@ 2020-02-10 21:42           ` Tushar Sugandhi
       [not found]           ` <0c9099b5-da29-3e71-0933-123dfe08442c@linux.microsoft.com>
  1 sibling, 0 replies; 23+ messages in thread
From: Tushar Sugandhi @ 2020-02-10 21:42 UTC (permalink / raw)
  To: Joe Perches, Lakshmi Ramasubramanian, Mimi Zohar, linux-integrity, khan
  Cc: sashal, linux-kernel



On 2020-02-10 8:50 a.m., Joe Perches wrote:
> On Mon, 2020-02-10 at 08:40 -0800, Lakshmi Ramasubramanian wrote:
>> On 2/9/20 6:46 PM, Joe Perches wrote:
>>
>>>> In addition, as Shuah Khan suggested for the security/integrity/
>>>> directory, "there is an opportunity here to add #define pr_fmt(fmt)
>>>> KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
>>>> defines."
>>
>> Good point - we'll make that change.
>>
>> With Joe Perches patch (waiting for it to be re-posted),
>>>> are all the pr_fmt definitions needed in each file in the
>>>> integrity/ima directory?
>>>
>>> btw Tushar and Lakshmi:
>>>
>>> I am not formally submitting a patch here.
>>>
>>> I was just making suggestions and please do
>>> with it as you think appropriate.
>>
>> Joe - it's not clear to me what you are suggesting.
>> We'll move the #define for pr_fmt to integrity.h.
>>
>> What's other changes are you proposing?
> 
> https://lore.kernel.org/lkml/4b4ee302f2f97e3907ab03e55a92ccd46b6cf171.camel@perches.com/
> 
Thanks Joe.

Joe, Shuah:

Could one of you please clarify if the changes proposed in the above URL 
will be part of Shuah's future patchset?

Or should I include those in my patchset? I am referring to the 
following snippet in security/integrity/integrity.h.


+#ifdef pr_fmt
+#undef pr_fmt
+#endif
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " KBUILD_BASENAME ": " fmt
+

If I add the above in my patchset, I believe I should remove #defines 
for pr_fmt in the .c files under /security/integrity? (except the below one)
latform_certs/efi_parser.c:#define pr_fmt(fmt) "EFI: "fmt

Please let me know.

Thanks,
Tushar

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
       [not found]           ` <0c9099b5-da29-3e71-0933-123dfe08442c@linux.microsoft.com>
@ 2020-02-10 21:46             ` Mimi Zohar
  2020-02-10 22:19               ` Tushar Sugandhi
  0 siblings, 1 reply; 23+ messages in thread
From: Mimi Zohar @ 2020-02-10 21:46 UTC (permalink / raw)
  To: Tushar Sugandhi, Joe Perches, Lakshmi Ramasubramanian,
	linux-integrity, khan
  Cc: sashal, linux-kernel

Hi Tushar,

On Mon, 2020-02-10 at 13:33 -0800, Tushar Sugandhi wrote:
> On 2020-02-10 8:50 a.m., Joe Perches wrote:
> > On Mon, 2020-02-10 at 08:40 -0800, Lakshmi Ramasubramanian wrote:
> >> On 2/9/20 6:46 PM, Joe Perches wrote:
> >>
> >>>> In addition, as Shuah Khan suggested for the security/integrity/
> >>>> directory, "there is an opportunity here to add #define pr_fmt(fmt)
> >>>> KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
> >>>> defines."
> >> Good point - we'll make that change.
> >>
> >> With Joe Perches patch (waiting for it to be re-posted),
> >>>> are all the pr_fmt definitions needed in each file in the
> >>>> integrity/ima directory?
> >>> btw Tushar and Lakshmi:
> >>>
> >>> I am not formally submitting a patch here.
> >>>
> >>> I was just making suggestions and please do
> >>> with it as you think appropriate.
> >> Joe - it's not clear to me what you are suggesting.
> >> We'll move the #define for pr_fmt to integrity.h.
> >>
> >> What's other changes are you proposing?
> > https://lore.kernel.org/lkml/4b4ee302f2f97e3907ab03e55a92ccd46b6cf171.camel@perches.com/
> >
> Thanks Joe.
> 
> Joe, Shuah:
> 
> Could one of you please clarify if the changes proposed in the above URL 
> will be part of Shuah's future patchset?
> 
> Or should I include those in my patchset? I am referring to the 
> following snippet in security/integrity/integrity.h.

Joe is saying that he made some suggestions, which Shuah commented on,
but has no intention of posting a formal patch.  The end result of
that discussion is to define pr_fmt once in integrity/integrity.h and
remove any duplication in the integrity/ files.

I'd appreciate your including that change in this patch set, and if
needed a similar one in ima/ima.h.

thanks,

Mimi


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions.
  2020-02-10 21:46             ` Mimi Zohar
@ 2020-02-10 22:19               ` Tushar Sugandhi
  0 siblings, 0 replies; 23+ messages in thread
From: Tushar Sugandhi @ 2020-02-10 22:19 UTC (permalink / raw)
  To: Mimi Zohar, Joe Perches, Lakshmi Ramasubramanian, linux-integrity, khan
  Cc: sashal, linux-kernel

Thanks Mimi.

On 2020-02-10 1:46 p.m., Mimi Zohar wrote:
> Hi Tushar,
> 
> On Mon, 2020-02-10 at 13:33 -0800, Tushar Sugandhi wrote:
>> On 2020-02-10 8:50 a.m., Joe Perches wrote:
>>> On Mon, 2020-02-10 at 08:40 -0800, Lakshmi Ramasubramanian wrote:
>>>> On 2/9/20 6:46 PM, Joe Perches wrote:
>>>>
>>>>>> In addition, as Shuah Khan suggested for the security/integrity/
>>>>>> directory, "there is an opportunity here to add #define pr_fmt(fmt)
>>>>>> KBUILD_MODNAME ": " fmt to integrity.h and get rid of duplicate
>>>>>> defines."
>>>> Good point - we'll make that change.
>>>>
>>>> With Joe Perches patch (waiting for it to be re-posted),
>>>>>> are all the pr_fmt definitions needed in each file in the
>>>>>> integrity/ima directory?
>>>>> btw Tushar and Lakshmi:
>>>>>
>>>>> I am not formally submitting a patch here.
>>>>>
>>>>> I was just making suggestions and please do
>>>>> with it as you think appropriate.
>>>> Joe - it's not clear to me what you are suggesting.
>>>> We'll move the #define for pr_fmt to integrity.h.
>>>>
>>>> What's other changes are you proposing?
>>> https://lore.kernel.org/lkml/4b4ee302f2f97e3907ab03e55a92ccd46b6cf171.camel@perches.com/
>>>
>> Thanks Joe.
>>
>> Joe, Shuah:
>>
>> Could one of you please clarify if the changes proposed in the above URL
>> will be part of Shuah's future patchset?
>>
>> Or should I include those in my patchset? I am referring to the
>> following snippet in security/integrity/integrity.h.
> 
> Joe is saying that he made some suggestions, which Shuah commented on,
> but has no intention of posting a formal patch.  The end result of
> that discussion is to define pr_fmt once in integrity/integrity.h and
> remove any duplication in the integrity/ files.
> 
> I'd appreciate your including that change in this patch set, and if
> needed a similar one in ima/ima.h.
I will add the proposed change to pr_fmt to this patchset.
I will also check if a similar change is needed in ima/ima.h.
> 
> thanks,
> 
> Mimi
> 

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 21:34             ` Mimi Zohar
@ 2020-06-05 21:36               ` Lakshmi Ramasubramanian
  -1 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 21:36 UTC (permalink / raw)
  To: Mimi Zohar, Paul Moore
  Cc: linux-integrity, tusharsu, linux-kernel, linux-audit

On 6/5/20 2:34 PM, Mimi Zohar wrote:

>>
>> Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate
>> strings for "op" and "cause".
>>
>> Mimi - please let me know if you think this audit_msgno would be ok to
>> use. I see this code used, for instance, for boot aggregate measurement.
>>
>> integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
>> 		    audit_cause, result, 0);
> 
> Yes, AUDIT_INTEGRITY_PCR is also used for failures to add to the
> measurement list.
> 

thanks - i'll post an updated patch shortly.

  -lakshmi


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 21:36               ` Lakshmi Ramasubramanian
  0 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 21:36 UTC (permalink / raw)
  To: Mimi Zohar, Paul Moore
  Cc: tusharsu, linux-integrity, linux-audit, linux-kernel

On 6/5/20 2:34 PM, Mimi Zohar wrote:

>>
>> Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate
>> strings for "op" and "cause".
>>
>> Mimi - please let me know if you think this audit_msgno would be ok to
>> use. I see this code used, for instance, for boot aggregate measurement.
>>
>> integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
>> 		    audit_cause, result, 0);
> 
> Yes, AUDIT_INTEGRITY_PCR is also used for failures to add to the
> measurement list.
> 

thanks - i'll post an updated patch shortly.

  -lakshmi

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 21:09           ` Lakshmi Ramasubramanian
@ 2020-06-05 21:34             ` Mimi Zohar
  -1 siblings, 0 replies; 23+ messages in thread
From: Mimi Zohar @ 2020-06-05 21:34 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian, Paul Moore
  Cc: linux-integrity, tusharsu, linux-kernel, linux-audit

On Fri, 2020-06-05 at 14:09 -0700, Lakshmi Ramasubramanian wrote:
> On 6/5/20 1:49 PM, Paul Moore wrote:
> 
> > 
> >> Since a pr_xyz() call was already present, I just wanted to change the
> >> log level to keep the code change to the minimum. But if audit log is
> >> the right approach for this case, I'll update.
> > 
> > Generally we reserve audit for things that are required for various
> > security certifications and/or "security relevant".  From what you
> > mentioned above, it seems like this would fall into the second
> > category if not the first.
> > 
> > Looking at your patch it doesn't look like you are trying to record
> > anything special so you may be able to use the existing
> > integrity_audit_msg(...) helper.  Of course then the question comes
> > down to the audit record type (the audit_msgno argument), the
> > operation (op), and the comm/cause (cause).
> > 
> > Do you feel that any of the existing audit record types are a good fit for this?
> > 
> 
> Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate 
> strings for "op" and "cause".
> 
> Mimi - please let me know if you think this audit_msgno would be ok to 
> use. I see this code used, for instance, for boot aggregate measurement.
> 
> integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
> 		    audit_cause, result, 0);

Yes, AUDIT_INTEGRITY_PCR is also used for failures to add to the
measurement list.

thanks,

Mimi

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 21:34             ` Mimi Zohar
  0 siblings, 0 replies; 23+ messages in thread
From: Mimi Zohar @ 2020-06-05 21:34 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian, Paul Moore
  Cc: tusharsu, linux-integrity, linux-audit, linux-kernel

On Fri, 2020-06-05 at 14:09 -0700, Lakshmi Ramasubramanian wrote:
> On 6/5/20 1:49 PM, Paul Moore wrote:
> 
> > 
> >> Since a pr_xyz() call was already present, I just wanted to change the
> >> log level to keep the code change to the minimum. But if audit log is
> >> the right approach for this case, I'll update.
> > 
> > Generally we reserve audit for things that are required for various
> > security certifications and/or "security relevant".  From what you
> > mentioned above, it seems like this would fall into the second
> > category if not the first.
> > 
> > Looking at your patch it doesn't look like you are trying to record
> > anything special so you may be able to use the existing
> > integrity_audit_msg(...) helper.  Of course then the question comes
> > down to the audit record type (the audit_msgno argument), the
> > operation (op), and the comm/cause (cause).
> > 
> > Do you feel that any of the existing audit record types are a good fit for this?
> > 
> 
> Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate 
> strings for "op" and "cause".
> 
> Mimi - please let me know if you think this audit_msgno would be ok to 
> use. I see this code used, for instance, for boot aggregate measurement.
> 
> integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
> 		    audit_cause, result, 0);

Yes, AUDIT_INTEGRITY_PCR is also used for failures to add to the
measurement list.

thanks,

Mimi

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 20:49         ` Paul Moore
@ 2020-06-05 21:09           ` Lakshmi Ramasubramanian
  -1 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 21:09 UTC (permalink / raw)
  To: Paul Moore
  Cc: Mimi Zohar, linux-integrity, tusharsu, linux-kernel, linux-audit

On 6/5/20 1:49 PM, Paul Moore wrote:

> 
>> Since a pr_xyz() call was already present, I just wanted to change the
>> log level to keep the code change to the minimum. But if audit log is
>> the right approach for this case, I'll update.
> 
> Generally we reserve audit for things that are required for various
> security certifications and/or "security relevant".  From what you
> mentioned above, it seems like this would fall into the second
> category if not the first.
> 
> Looking at your patch it doesn't look like you are trying to record
> anything special so you may be able to use the existing
> integrity_audit_msg(...) helper.  Of course then the question comes
> down to the audit record type (the audit_msgno argument), the
> operation (op), and the comm/cause (cause).
> 
> Do you feel that any of the existing audit record types are a good fit for this?
> 

Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate 
strings for "op" and "cause".

Mimi - please let me know if you think this audit_msgno would be ok to 
use. I see this code used, for instance, for boot aggregate measurement.

integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
		    audit_cause, result, 0);

thanks,
  -lakshmi

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 21:09           ` Lakshmi Ramasubramanian
  0 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 21:09 UTC (permalink / raw)
  To: Paul Moore
  Cc: tusharsu, linux-integrity, linux-audit, linux-kernel, Mimi Zohar

On 6/5/20 1:49 PM, Paul Moore wrote:

> 
>> Since a pr_xyz() call was already present, I just wanted to change the
>> log level to keep the code change to the minimum. But if audit log is
>> the right approach for this case, I'll update.
> 
> Generally we reserve audit for things that are required for various
> security certifications and/or "security relevant".  From what you
> mentioned above, it seems like this would fall into the second
> category if not the first.
> 
> Looking at your patch it doesn't look like you are trying to record
> anything special so you may be able to use the existing
> integrity_audit_msg(...) helper.  Of course then the question comes
> down to the audit record type (the audit_msgno argument), the
> operation (op), and the comm/cause (cause).
> 
> Do you feel that any of the existing audit record types are a good fit for this?
> 

Maybe I can use the audit_msgno "AUDIT_INTEGRITY_PCR" with appropriate 
strings for "op" and "cause".

Mimi - please let me know if you think this audit_msgno would be ok to 
use. I see this code used, for instance, for boot aggregate measurement.

integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
		    audit_cause, result, 0);

thanks,
  -lakshmi

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 19:54       ` Lakshmi Ramasubramanian
@ 2020-06-05 20:49         ` Paul Moore
  -1 siblings, 0 replies; 23+ messages in thread
From: Paul Moore @ 2020-06-05 20:49 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian
  Cc: Mimi Zohar, linux-integrity, tusharsu, linux-kernel, linux-audit

On Fri, Jun 5, 2020 at 3:54 PM Lakshmi Ramasubramanian
<nramas@linux.microsoft.com> wrote:
> On 6/5/20 12:37 PM, Paul Moore wrote:
>
> > If it's audit related, it's generally best to CC the linux-audit list,
> > not just me (fixed).
> >
> > It's not clear to me what this pr_err() is trying to indicate other
> > than *something* failed.  Can someone provide some more background on
> > this message?
>
> process_buffer_measurement() is currently used to measure
> "kexec command line", "keys", and "blacklist-hash". If there was any
> error in the measurement, this pr_err() will indicate which of the above
> measurement failed and the related error code.
>
> Please let me know if you need more info on this one.

That helps, thank you.

> Since a pr_xyz() call was already present, I just wanted to change the
> log level to keep the code change to the minimum. But if audit log is
> the right approach for this case, I'll update.

Generally we reserve audit for things that are required for various
security certifications and/or "security relevant".  From what you
mentioned above, it seems like this would fall into the second
category if not the first.

Looking at your patch it doesn't look like you are trying to record
anything special so you may be able to use the existing
integrity_audit_msg(...) helper.  Of course then the question comes
down to the audit record type (the audit_msgno argument), the
operation (op), and the comm/cause (cause).

Do you feel that any of the existing audit record types are a good fit for this?

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 20:49         ` Paul Moore
  0 siblings, 0 replies; 23+ messages in thread
From: Paul Moore @ 2020-06-05 20:49 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian
  Cc: tusharsu, linux-integrity, linux-audit, linux-kernel, Mimi Zohar

On Fri, Jun 5, 2020 at 3:54 PM Lakshmi Ramasubramanian
<nramas@linux.microsoft.com> wrote:
> On 6/5/20 12:37 PM, Paul Moore wrote:
>
> > If it's audit related, it's generally best to CC the linux-audit list,
> > not just me (fixed).
> >
> > It's not clear to me what this pr_err() is trying to indicate other
> > than *something* failed.  Can someone provide some more background on
> > this message?
>
> process_buffer_measurement() is currently used to measure
> "kexec command line", "keys", and "blacklist-hash". If there was any
> error in the measurement, this pr_err() will indicate which of the above
> measurement failed and the related error code.
>
> Please let me know if you need more info on this one.

That helps, thank you.

> Since a pr_xyz() call was already present, I just wanted to change the
> log level to keep the code change to the minimum. But if audit log is
> the right approach for this case, I'll update.

Generally we reserve audit for things that are required for various
security certifications and/or "security relevant".  From what you
mentioned above, it seems like this would fall into the second
category if not the first.

Looking at your patch it doesn't look like you are trying to record
anything special so you may be able to use the existing
integrity_audit_msg(...) helper.  Of course then the question comes
down to the audit record type (the audit_msgno argument), the
operation (op), and the comm/cause (cause).

Do you feel that any of the existing audit record types are a good fit for this?

-- 
paul moore
www.paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 19:37     ` Paul Moore
@ 2020-06-05 19:54       ` Lakshmi Ramasubramanian
  -1 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 19:54 UTC (permalink / raw)
  To: Paul Moore, Mimi Zohar
  Cc: linux-integrity, tusharsu, linux-kernel, linux-audit

On 6/5/20 12:37 PM, Paul Moore wrote:

> If it's audit related, it's generally best to CC the linux-audit list,
> not just me (fixed).
> 
> It's not clear to me what this pr_err() is trying to indicate other
> than *something* failed.  Can someone provide some more background on
> this message?

process_buffer_measurement() is currently used to measure
"kexec command line", "keys", and "blacklist-hash". If there was any 
error in the measurement, this pr_err() will indicate which of the above 
measurement failed and the related error code.

Please let me know if you need more info on this one.

Since a pr_xyz() call was already present, I just wanted to change the 
log level to keep the code change to the minimum. But if audit log is 
the right approach for this case, I'll update.

thanks,
  -lakshmi



^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 19:54       ` Lakshmi Ramasubramanian
  0 siblings, 0 replies; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-05 19:54 UTC (permalink / raw)
  To: Paul Moore, Mimi Zohar
  Cc: tusharsu, linux-integrity, linux-audit, linux-kernel

On 6/5/20 12:37 PM, Paul Moore wrote:

> If it's audit related, it's generally best to CC the linux-audit list,
> not just me (fixed).
> 
> It's not clear to me what this pr_err() is trying to indicate other
> than *something* failed.  Can someone provide some more background on
> this message?

process_buffer_measurement() is currently used to measure
"kexec command line", "keys", and "blacklist-hash". If there was any 
error in the measurement, this pr_err() will indicate which of the above 
measurement failed and the related error code.

Please let me know if you need more info on this one.

Since a pr_xyz() call was already present, I just wanted to change the 
log level to keep the code change to the minimum. But if audit log is 
the right approach for this case, I'll update.

thanks,
  -lakshmi


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-05 18:46 ` Mimi Zohar
@ 2020-06-05 19:37     ` Paul Moore
  0 siblings, 0 replies; 23+ messages in thread
From: Paul Moore @ 2020-06-05 19:37 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: Lakshmi Ramasubramanian, linux-integrity, tusharsu, linux-kernel,
	linux-audit

On Fri, Jun 5, 2020 at 2:46 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
>
> [Cc'ing Paul Moore]

If it's audit related, it's generally best to CC the linux-audit list,
not just me (fixed).

It's not clear to me what this pr_err() is trying to indicate other
than *something* failed.  Can someone provide some more background on
this message?

> Hi Lakshmi,
>
> On Thu, 2020-06-04 at 09:32 -0700, Lakshmi Ramasubramanian wrote:
> > The final log statement in process_buffer_measurement() for failure
> > condition is at debug level. This does not log the message unless
> > the system log level is raised which would significantly increase
> > the messages in the system log. Change this log message to error level,
> > and add eventname and ima_hooks enum to the message for better triaging
> > failures in the function.
> >
> > ima_alloc_key_entry() does not log a message for failure condition.
> > Add an error message for failure condition in this function.
> >
> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
>
> These messages should probably be turned into audit messages.  Look at
> integerity_audit_msg().
>
> Mimi
>
> > ---
> >  security/integrity/ima/ima_main.c       | 3 ++-
> >  security/integrity/ima/ima_queue_keys.c | 2 ++
> >  2 files changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > index 9d0abedeae77..3b371f31597b 100644
> > --- a/security/integrity/ima/ima_main.c
> > +++ b/security/integrity/ima/ima_main.c
> > @@ -756,7 +756,8 @@ void process_buffer_measurement(const void *buf, int size,
> >
> >  out:
> >       if (ret < 0)
> > -             pr_devel("%s: failed, result: %d\n", __func__, ret);
> > +             pr_err("%s failed. eventname: %s, func: %d, result: %d\n",
> > +                    __func__, eventname, func, ret);
> >
> >       return;
> >  }
> > diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
> > index cb3e3f501593..e51d0eb08d8a 100644
> > --- a/security/integrity/ima/ima_queue_keys.c
> > +++ b/security/integrity/ima/ima_queue_keys.c
> > @@ -88,6 +88,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
> >
> >  out:
> >       if (rc) {
> > +             pr_err("%s failed. keyring: %s, result: %d\n",
> > +                    __func__, keyring->description, rc);
> >               ima_free_key_entry(entry);
> >               entry = NULL;
> >       }
>


-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-05 19:37     ` Paul Moore
  0 siblings, 0 replies; 23+ messages in thread
From: Paul Moore @ 2020-06-05 19:37 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: tusharsu, Lakshmi Ramasubramanian, linux-integrity, linux-audit,
	linux-kernel

On Fri, Jun 5, 2020 at 2:46 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
>
> [Cc'ing Paul Moore]

If it's audit related, it's generally best to CC the linux-audit list,
not just me (fixed).

It's not clear to me what this pr_err() is trying to indicate other
than *something* failed.  Can someone provide some more background on
this message?

> Hi Lakshmi,
>
> On Thu, 2020-06-04 at 09:32 -0700, Lakshmi Ramasubramanian wrote:
> > The final log statement in process_buffer_measurement() for failure
> > condition is at debug level. This does not log the message unless
> > the system log level is raised which would significantly increase
> > the messages in the system log. Change this log message to error level,
> > and add eventname and ima_hooks enum to the message for better triaging
> > failures in the function.
> >
> > ima_alloc_key_entry() does not log a message for failure condition.
> > Add an error message for failure condition in this function.
> >
> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
>
> These messages should probably be turned into audit messages.  Look at
> integerity_audit_msg().
>
> Mimi
>
> > ---
> >  security/integrity/ima/ima_main.c       | 3 ++-
> >  security/integrity/ima/ima_queue_keys.c | 2 ++
> >  2 files changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > index 9d0abedeae77..3b371f31597b 100644
> > --- a/security/integrity/ima/ima_main.c
> > +++ b/security/integrity/ima/ima_main.c
> > @@ -756,7 +756,8 @@ void process_buffer_measurement(const void *buf, int size,
> >
> >  out:
> >       if (ret < 0)
> > -             pr_devel("%s: failed, result: %d\n", __func__, ret);
> > +             pr_err("%s failed. eventname: %s, func: %d, result: %d\n",
> > +                    __func__, eventname, func, ret);
> >
> >       return;
> >  }
> > diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
> > index cb3e3f501593..e51d0eb08d8a 100644
> > --- a/security/integrity/ima/ima_queue_keys.c
> > +++ b/security/integrity/ima/ima_queue_keys.c
> > @@ -88,6 +88,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
> >
> >  out:
> >       if (rc) {
> > +             pr_err("%s failed. keyring: %s, result: %d\n",
> > +                    __func__, keyring->description, rc);
> >               ima_free_key_entry(entry);
> >               entry = NULL;
> >       }
>


-- 
paul moore
www.paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 23+ messages in thread
* Re: [PATCH] IMA: Add log statements for failure conditions
  2020-06-04 16:32 Lakshmi Ramasubramanian
@ 2020-06-05 18:46 ` Mimi Zohar
  2020-06-05 19:37     ` Paul Moore
  0 siblings, 1 reply; 23+ messages in thread
From: Mimi Zohar @ 2020-06-05 18:46 UTC (permalink / raw)
  To: Lakshmi Ramasubramanian, linux-integrity
  Cc: tusharsu, linux-kernel, Paul Moore

[Cc'ing Paul Moore]

Hi Lakshmi,

On Thu, 2020-06-04 at 09:32 -0700, Lakshmi Ramasubramanian wrote:
> The final log statement in process_buffer_measurement() for failure
> condition is at debug level. This does not log the message unless
> the system log level is raised which would significantly increase
> the messages in the system log. Change this log message to error level,
> and add eventname and ima_hooks enum to the message for better triaging
> failures in the function.
> 
> ima_alloc_key_entry() does not log a message for failure condition.
> Add an error message for failure condition in this function.
> 
> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>

These messages should probably be turned into audit messages.  Look at
integerity_audit_msg().

Mimi

> ---
>  security/integrity/ima/ima_main.c       | 3 ++-
>  security/integrity/ima/ima_queue_keys.c | 2 ++
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 9d0abedeae77..3b371f31597b 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -756,7 +756,8 @@ void process_buffer_measurement(const void *buf, int size,
>  
>  out:
>  	if (ret < 0)
> -		pr_devel("%s: failed, result: %d\n", __func__, ret);
> +		pr_err("%s failed. eventname: %s, func: %d, result: %d\n",
> +		       __func__, eventname, func, ret);
>  
>  	return;
>  }
> diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
> index cb3e3f501593..e51d0eb08d8a 100644
> --- a/security/integrity/ima/ima_queue_keys.c
> +++ b/security/integrity/ima/ima_queue_keys.c
> @@ -88,6 +88,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
>  
>  out:
>  	if (rc) {
> +		pr_err("%s failed. keyring: %s, result: %d\n",
> +		       __func__, keyring->description, rc);
>  		ima_free_key_entry(entry);
>  		entry = NULL;
>  	}


^ permalink raw reply	[flat|nested] 23+ messages in thread
* [PATCH] IMA: Add log statements for failure conditions
@ 2020-06-04 16:32 Lakshmi Ramasubramanian
  2020-06-05 18:46 ` Mimi Zohar
  0 siblings, 1 reply; 23+ messages in thread
From: Lakshmi Ramasubramanian @ 2020-06-04 16:32 UTC (permalink / raw)
  To: zohar, linux-integrity; +Cc: tusharsu, linux-kernel

The final log statement in process_buffer_measurement() for failure
condition is at debug level. This does not log the message unless
the system log level is raised which would significantly increase
the messages in the system log. Change this log message to error level,
and add eventname and ima_hooks enum to the message for better triaging
failures in the function.

ima_alloc_key_entry() does not log a message for failure condition.
Add an error message for failure condition in this function.

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
 security/integrity/ima/ima_main.c       | 3 ++-
 security/integrity/ima/ima_queue_keys.c | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 9d0abedeae77..3b371f31597b 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -756,7 +756,8 @@ void process_buffer_measurement(const void *buf, int size,
 
 out:
 	if (ret < 0)
-		pr_devel("%s: failed, result: %d\n", __func__, ret);
+		pr_err("%s failed. eventname: %s, func: %d, result: %d\n",
+		       __func__, eventname, func, ret);
 
 	return;
 }
diff --git a/security/integrity/ima/ima_queue_keys.c b/security/integrity/ima/ima_queue_keys.c
index cb3e3f501593..e51d0eb08d8a 100644
--- a/security/integrity/ima/ima_queue_keys.c
+++ b/security/integrity/ima/ima_queue_keys.c
@@ -88,6 +88,8 @@ static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring,
 
 out:
 	if (rc) {
+		pr_err("%s failed. keyring: %s, result: %d\n",
+		       __func__, keyring->description, rc);
 		ima_free_key_entry(entry);
 		entry = NULL;
 	}
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread
end of thread, other threads:[~2020-06-06  2:51 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-07 19:53 [PATCH] IMA: Updated KBUILD_MODNAME for IMA files to ima Tushar Sugandhi
2020-02-07 19:53 ` [PATCH] IMA: Add log statements for failure conditions Tushar Sugandhi
2020-02-09 12:57   ` Mimi Zohar
2020-02-10  2:46     ` Joe Perches
2020-02-10 16:40       ` Lakshmi Ramasubramanian
2020-02-10 16:50         ` Joe Perches
2020-02-10 21:42           ` Tushar Sugandhi
     [not found]           ` <0c9099b5-da29-3e71-0933-123dfe08442c@linux.microsoft.com>
2020-02-10 21:46             ` Mimi Zohar
2020-02-10 22:19               ` Tushar Sugandhi
2020-06-04 16:32 Lakshmi Ramasubramanian
2020-06-05 18:46 ` Mimi Zohar
2020-06-05 19:37   ` Paul Moore
2020-06-05 19:37     ` Paul Moore
2020-06-05 19:54     ` Lakshmi Ramasubramanian
2020-06-05 19:54       ` Lakshmi Ramasubramanian
2020-06-05 20:49       ` Paul Moore
2020-06-05 20:49         ` Paul Moore
2020-06-05 21:09         ` Lakshmi Ramasubramanian
2020-06-05 21:09           ` Lakshmi Ramasubramanian
2020-06-05 21:34           ` Mimi Zohar
2020-06-05 21:34             ` Mimi Zohar
2020-06-05 21:36             ` Lakshmi Ramasubramanian
2020-06-05 21:36               ` Lakshmi Ramasubramanian

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.