From nobody Tue Sep 9 21:36:14 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8F8CC64ED6 for ; Wed, 1 Mar 2023 11:34:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230051AbjCALem (ORCPT ); Wed, 1 Mar 2023 06:34:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47616 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229510AbjCALeh (ORCPT ); Wed, 1 Mar 2023 06:34:37 -0500 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.17.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BD0AD2FCD0; Wed, 1 Mar 2023 03:34:33 -0800 (PST) Received: from weisslap.aisec.fraunhofer.de ([31.19.218.61]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MLA6m-1pFFuO0kpm-00IEk1; Wed, 01 Mar 2023 12:34:22 +0100 From: =?UTF-8?q?Michael=20Wei=C3=9F?= To: Paul Moore Cc: Richard Guy Briggs , Mikulas Patocka , gyroidos@aisec.fraunhofer.de, =?UTF-8?q?Michael=20Wei=C3=9F?= , Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com (maintainer:DEVICE-MAPPER (LVM)), Eric Paris , linux-kernel@vger.kernel.org (open list), audit@vger.kernel.org (open list:AUDIT SUBSYSTEM) Subject: [PATCH] dm verity: log audit events for dm-verity target Date: Wed, 1 Mar 2023 12:34:15 +0100 Message-Id: <20230301113415.47664-1-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:tGtzLe56BXPRA/UJkQiHxLFGUNAsPjaOFYy/tcw9+uPqPJpJz3Z zj5Ye3Z3imqH6MRW+/HoKV3+n0oBXdPXSOf0LxvF2DeTb2JppDQpq7sQyQ37j1FL5FEwSRD cv3elYOu1ZkvMmjJsZvSAqFRI9ce18cvY2ehQZsiCCxNdrHNO5WPznAhvTmRUB4YFtQP8kr 1ubAow1SvYeIt6QIB/L/w== UI-OutboundReport: notjunk:1;M01:P0:3+LLLmlVKGE=;gastDA8YfJAfdqLlsH0jFPN6yVJ 7ZIOlYmcHdb21dBEPg/HbaOG2a9LOy35DRcsE6+AYUrCnAsajzbo7HjWDrcwhdaP+nQE3Ojq3 2mvydV49qUIDu2NpLqiTYaEnCd1Xu1SeV4en11qmDogveFs6E6FHfM/dODSXqmCxyB95L25Wk 2ILRFKr3k24HZ8T7LJMAdR0wHqeg64Ismpk9OAGBhhmK91fap/v0Mndc/AECDuFhvAs1C+YFC AkxUav5auvRwVR9EZVeHL6RuFQV89oEUw5zM3zh8sX06+S8ao7wMXLr6/nxmpvMbJMMgf6jAF f8Q/kBCOR83eM0YlIsHpmXTZt+5BO6QjR/BGb+FuTmp8gRzGUN5EfX5MM3NLmhr4bJXBWJUQW APApuDDot99iSugazmMFipUWmMnxT4IOAQCqgep3L+Z2OPLZfF7GRBTQKgDmbQfIsmp4u+9Om gOv3RxK9FpTnOXj0VmaSgGX0T1y0hunXDyyQ41Si2buLOSa24X+BhtGICrcPHETu2kMl1m8cS 3cu2zp0H8UTS6VJb94nAmaVdK1f3xOEeZO62+im38GbJN5DtlhfrqUhHm4OwD8F1CCakujcFW WxM16Dg/dzU534Cs5CKWjc2FWnQgaAeyvFkzUHmzmITX9kGz7INqcFJlkJPb6SgYLr4ZrzQln sPeLlSQWHxnpclMKOdgsFsrP6AHtGwghOY4g6DCoEw== Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org dm-verity signals integrity violations by returning I/O errors to user space. To identify integrity violations by a controlling instance, the kernel audit subsystem can be used to emit audit events to user space. Analogous to dm-integrity, we also use the dm-audit submodule allowing to emit audit events on verification failures of metadata and data blocks as well as if max corrupted errors are reached. The construction and destruction of verity device mappings are also relevant for auditing a system. Thus, those events are also logged as audit events. We tested this by starting a container with the container manager (cmld) of GyroidOS which uses a dm-verity protected rootfs image root.img mapped to /dev/mapper/-root. We than manipulated one block in the underlying image file and reading it from the protected mapper device again and again until we reach the max corrupted errors like this: dd if=3D/dev/urandom of=3Droot.img bs=3D512 count=3D1 seek=3D1000 for i in range {1..101}; do \ dd if=3D/dev/mapper/-root of=3D/dev/null bs=3D4096 \ count=3D1 skip=3D1000 \ done The resulting audit log looks as follows: type=3DDM_CTRL msg=3Daudit(1677618791.876:962): module=3Dverity op=3Dctr ppid=3D4876 pid=3D29102 auid=3D0 uid=3D0 gid= =3D0 euid=3D0 suid=3D0 fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 tty=3D(none) se= s=3D44 comm=3D"cmld" exe=3D"/usr/sbin/cml/cmld" subj=3Dunconfined dev=3D254:3 error_msg=3D'success' res=3D1 type=3DDM_EVENT msg=3Daudit(1677619463.786:1074): module=3Dverity op=3Dverify-data dev=3D7:0 sector=3D1000 res=3D0 ... type=3DDM_EVENT msg=3Daudit(1677619596.727:1162): module=3Dverity op=3Dverify-data dev=3D7:0 sector=3D1000 res=3D0 type=3DDM_EVENT msg=3Daudit(1677619596.731:1163): module=3Dverity op=3Dmax-corrupted-errors dev=3D254:3 sector=3D? res=3D0 Signed-off-by: Michael Wei=C3=9F Acked-by: Paul Moore --- drivers/md/dm-verity-target.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index ade83ef3b439..8beeb4ea66d1 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -16,6 +16,7 @@ #include "dm-verity.h" #include "dm-verity-fec.h" #include "dm-verity-verify-sig.h" +#include "dm-audit.h" #include #include #include @@ -248,8 +249,10 @@ static int verity_handle_err(struct dm_verity *v, enum= verity_block_type type, DMERR_LIMIT("%s: %s block %llu is corrupted", v->data_dev->name, type_str, block); =20 - if (v->corrupted_errs =3D=3D DM_VERITY_MAX_CORRUPTED_ERRS) + if (v->corrupted_errs =3D=3D DM_VERITY_MAX_CORRUPTED_ERRS) { DMERR("%s: reached maximum errors", v->data_dev->name); + dm_audit_log_target(DM_MSG_PREFIX, "max-corrupted-errors", v->ti, 0); + } =20 snprintf(verity_env, DM_VERITY_ENV_LENGTH, "%s=3D%d,%llu", DM_VERITY_ENV_VAR_NAME, type, block); @@ -340,6 +343,11 @@ static int verity_verify_level(struct dm_verity *v, st= ruct dm_verity_io *io, else if (verity_handle_err(v, DM_VERITY_BLOCK_TYPE_METADATA, hash_block)) { + struct bio *bio =3D + dm_bio_from_per_bio_data(io, + v->ti->per_io_data_size); + dm_audit_log_bio(DM_MSG_PREFIX, "verify-metadata", bio, + block, 0); r =3D -EIO; goto release_ret_r; } @@ -590,8 +598,11 @@ static int verity_verify_io(struct dm_verity_io *io) return -EIO; } if (verity_handle_err(v, DM_VERITY_BLOCK_TYPE_DATA, - cur_block)) + cur_block)) { + dm_audit_log_bio(DM_MSG_PREFIX, "verify-data", + bio, cur_block, 0); return -EIO; + } } } =20 @@ -975,6 +986,8 @@ static void verity_dtr(struct dm_target *ti) static_branch_dec(&use_tasklet_enabled); =20 kfree(v); + + dm_audit_log_dtr(DM_MSG_PREFIX, ti, 1); } =20 static int verity_alloc_most_once(struct dm_verity *v) @@ -1429,11 +1442,14 @@ static int verity_ctr(struct dm_target *ti, unsigne= d int argc, char **argv) =20 verity_verify_sig_opts_cleanup(&verify_args); =20 + dm_audit_log_ctr(DM_MSG_PREFIX, ti, 1); + return 0; =20 bad: =20 verity_verify_sig_opts_cleanup(&verify_args); + dm_audit_log_ctr(DM_MSG_PREFIX, ti, 0); verity_dtr(ti); =20 return r; --=20 2.30.2