Bug 1478888 – Clevis should log privileged operations

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1478888 - Clevis should log privileged operations

Summary:	Clevis should log privileged operations

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	clevis (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	high Severity medium
Target Milestone:	rc
Target Release:	---
Assigned To:	Nathaniel McCallum
QA Contact:	Jiri Jaburek
Docs Contact:	Mirek Jahoda

URL:
Whiteboard:
Keywords:

Depends On:	1507653
Blocks:
	Show dependency tree / graph

Reported:	2017-08-07 08:51 EDT by Dmitri Pal
Modified:	2018-04-10 14:27 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	_clevis_ now logs privileged operations With this update, the _clevis-udisks2_ subpackage logs all attempted key recoveries to the Audit log, and the privileged operations can be now tracked using the Linux Audit system.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-04-10 14:27:23 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2018:0985	None	None	None	2018-04-10 14:27 EDT

Groups: None (edit)

Description Dmitri Pal 2017-08-07 08:51:34 EDT

Clevis UDisks2 support performs privileged operations on behalf of an unprivileged user. For the purposes of auditing, this privilege transition needs to be logged.

When this issue is addressed an audit event should show in the log as result of using clevis with a flash memory drive.

Comment 3 Nathaniel McCallum 2017-08-07 10:22:24 EDT

UDisks2 support currently logs messages to standard error for the purposes of debugging. However, we need to log all attempted key recoveries to the audit log since this recovery occurred on data obtained with elevated privileges.

Comment 16 Nathaniel McCallum 2018-01-08 10:25:46 EST

Clarification: clevis-udisks2 does logging. Not the entire framework.

Comment 19 errata-xmlrpc 2018-04-10 14:27:23 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0985

Note You need to log in before you can comment on or make changes to this bug.