ima: add support for AUDIT_INTEGRITY_EVM_XATTR records

In commit fa516b6 ("EVM: Allow runtime modification of the set of verified xattrs") support was added in the kernel for the AUDIT_INTEGRITY_EVM_XATTR record with the EVM_ADD_XATTRS config option. Its record number is 1806. It has a field "xattr=" with result field "res=". Add support for the record type number. Since the xattr field isn't searchable, a parser wasn't necessary. See: linux-audit#85 Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Blarse · Apr 14, 2019 · 8045381 · 8045381
1 parent c9db4ca
commit 8045381
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 0 deletions.
diff --git a/auparse/normalize_record_map.h b/auparse/normalize_record_map.h
@@ -99,6 +99,7 @@ _S(AUDIT_ANOM_LINK, "used-suspcious-link")
 //_S(AUDIT_INTEGRITY_HASH,"")
 //_S(AUDIT_INTEGRITY_PCR,"")
 //_S(AUDIT_INTEGRITY_RULE,"")
+//_S(AUDIT_INTEGRITY_EVM_XATTR,"")
 _S(AUDIT_KERNEL, "initialized-audit-subsystem")
 _S(AUDIT_ANOM_LOGIN_FAILURES, "failed-log-in-too-many-times-to")
 _S(AUDIT_ANOM_LOGIN_TIME, "attempted-log-in-during-unusual-hour-to")

diff --git a/lib/libaudit.h b/lib/libaudit.h
@@ -142,6 +142,9 @@ extern "C" {
 #define AUDIT_INTEGRITY_PCR		1804 /* PCR invalidation msgs */
 #define AUDIT_INTEGRITY_RULE		1805 /* Policy rule */
 #endif
+#ifndef AUDIT_INTEGRITY_EVM_XATTR
+#define AUDIT_INTEGRITY_EVM_XATTR	1806 /* New EVM-covered xattr */
+#endif
 
 #define AUDIT_FIRST_ANOM_MSG		2100
 #define AUDIT_LAST_ANOM_MSG		2199

diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
@@ -152,6 +152,7 @@ _S(AUDIT_INTEGRITY_STATUS,           "INTEGRITY_STATUS"              )
 _S(AUDIT_INTEGRITY_HASH,             "INTEGRITY_HASH"                )
 _S(AUDIT_INTEGRITY_PCR,              "INTEGRITY_PCR"                 )
 _S(AUDIT_INTEGRITY_RULE,             "INTEGRITY_RULE"                )
+_S(AUDIT_INTEGRITY_EVM_XATTR,        "INTEGRITY_EVM_XATTR"           )
 
 #ifdef WITH_APPARMOR
 _S(AUDIT_AA,                         "APPARMOR"                      )