Re: [PATCH v2] IMA: Add audit log for failure conditions

Hi Lakshmi, On Sun, 2020-06-07 at 15:14 -0700, Lakshmi Ramasubramanian wrote: > The final log statement in process_buffer_measurement() for failure > condition is at debug level. This does not log the message unless > the system log level is raised which would significantly increase > the messages in the system log. Change this log message to an audit > message for better triaging failures in the function. > > ima_alloc_key_entry() does not log a message for failure condition. > Add an audit message for failure condition in this function. > > Signed-off-by: Lakshmi Ramasubramanian <nramas(a)linux.microsoft.com&gt; Audit messages should be at a higher level. For example, "hashing_error", "collect_data", "invalid_pcr". In the "invalid_pcr" case, the audit log contains the reason - "ToMToU" or "open_writers" - as to why the measurement list doesn't match the PCR. Here you would want "measuring_keys", "measuring_boot_cmdline" with the reason it failed, not the function name "process_buffer_measurement". Userspace needs to be aware of the new audit messages. Maybe include samples of them in the cover letter.