dm integrity: log audit events for dm-integrity target

dm-integrity signals integrity violations by returning I/O errors
to user space. To identify integrity violations by a controlling
instance, the kernel audit subsystem can be used to emit audit
events to user space. We use the new dm-audit submodule allowing
to emit audit events on relevant I/O errors.

The construction and destruction of integrity device mappings are
also relevant for auditing a system. Thus, those events are also
logged as audit events.

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>

diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 1bc4f48e976528063d351c0e9abc65e29b8a6909..b5ea378e66cb1c26dcc41118ac60a220143acadd 100644 (file)
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -610,6 +610,7 @@ config DM_INTEGRITY
        select CRYPTO
        select CRYPTO_SKCIPHER
        select ASYNC_XOR
+       select DM_AUDIT if AUDIT
        help
          This device-mapper target emulates a block device that has
          additional per-sector tags that can be used for storing

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index dc03b70f6e65c59e52afe99341838189e10707a3..dd78baf4c7af458ff97108e1fafec50b9d9d1e43 100644 (file)
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -23,6 +23,8 @@
 #include <linux/async_tx.h>
 #include <linux/dm-bufio.h>
 
+#include "dm-audit.h"
+
 #define DM_MSG_PREFIX "integrity"
 
 #define DEFAULT_INTERLEAVE_SECTORS     32768
@@ -539,6 +541,7 @@ static int sb_mac(struct dm_integrity_c *ic, bool wr)
                }
                if (memcmp((__u8 *)ic->sb + (1 << SECTOR_SHIFT) - size, result, size)) {
                        dm_integrity_io_error(ic, "superblock mac", -EILSEQ);
+                       dm_audit_log_target(DM_MSG_PREFIX, "mac-superblock", ic->ti, 0);
                        return -EILSEQ;
                }
        }
@@ -876,8 +879,10 @@ static void rw_section_mac(struct dm_integrity_c *ic, unsigned section, bool wr)
                if (likely(wr))
                        memcpy(&js->mac, result + (j * JOURNAL_MAC_PER_SECTOR), JOURNAL_MAC_PER_SECTOR);
                else {
-                       if (memcmp(&js->mac, result + (j * JOURNAL_MAC_PER_SECTOR), JOURNAL_MAC_PER_SECTOR))
+                       if (memcmp(&js->mac, result + (j * JOURNAL_MAC_PER_SECTOR), JOURNAL_MAC_PER_SECTOR)) {
                                dm_integrity_io_error(ic, "journal mac", -EILSEQ);
+                               dm_audit_log_target(DM_MSG_PREFIX, "mac-journal", ic->ti, 0);
+                       }
                }
        }
 }
@@ -1782,10 +1787,15 @@ again:
                        if (unlikely(r)) {
                                if (r > 0) {
                                        char b[BDEVNAME_SIZE];
-                                       DMERR_LIMIT("%s: Checksum failed at sector 0x%llx", bio_devname(bio, b),
-                                                   (sector - ((r + ic->tag_size - 1) / ic->tag_size)));
+                                       sector_t s;
+
+                                       s = sector - ((r + ic->tag_size - 1) / ic->tag_size);
+                                       DMERR_LIMIT("%s: Checksum failed at sector 0x%llx",
+                                                   bio_devname(bio, b), s);
                                        r = -EILSEQ;
                                        atomic64_inc(&ic->number_of_mismatches);
+                                       dm_audit_log_bio(DM_MSG_PREFIX, "integrity-checksum",
+                                                        bio, s, 0);
                                }
                                if (likely(checksums != checksums_onstack))
                                        kfree(checksums);
@@ -1991,6 +2001,8 @@ retry_kmap:
                                        if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) {
                                                DMERR_LIMIT("Checksum failed when reading from journal, at sector 0x%llx",
                                                            logical_sector);
+                                               dm_audit_log_bio(DM_MSG_PREFIX, "journal-checksum",
+                                                                bio, logical_sector, 0);
                                        }
                                }
 #endif
@@ -2534,8 +2546,10 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start,
 
                                        integrity_sector_checksum(ic, sec + ((l - j) << ic->sb->log2_sectors_per_block),
                                                                  (char *)access_journal_data(ic, i, l), test_tag);
-                                       if (unlikely(memcmp(test_tag, journal_entry_tag(ic, je2), ic->tag_size)))
+                                       if (unlikely(memcmp(test_tag, journal_entry_tag(ic, je2), ic->tag_size))) {
                                                dm_integrity_io_error(ic, "tag mismatch when replaying journal", -EILSEQ);
+                                               dm_audit_log_target(DM_MSG_PREFIX, "integrity-replay-journal", ic->ti, 0);
+                                       }
                                }
 
                                journal_entry_set_unused(je2);
@@ -4514,9 +4528,11 @@ try_smaller_buffer:
        if (ic->discard)
                ti->num_discard_bios = 1;
 
+       dm_audit_log_ctr(DM_MSG_PREFIX, ti, 1);
        return 0;
 
 bad:
+       dm_audit_log_ctr(DM_MSG_PREFIX, ti, 0);
        dm_integrity_dtr(ti);
        return r;
 }
@@ -4590,6 +4606,7 @@ static void dm_integrity_dtr(struct dm_target *ti)
        free_alg(&ic->journal_mac_alg);
 
        kfree(ic);
+       dm_audit_log_dtr(DM_MSG_PREFIX, ti, 1);
 }
 
 static struct target_type integrity_target = {