This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1478888 - Clevis should log privileged operations
Clevis should log privileged operations
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: clevis (Show other bugs)
7.4
Unspecified Unspecified
high Severity medium
: rc
: ---
Assigned To: Nathaniel McCallum
BaseOS QE Security Team
: TestOnly
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-07 08:51 EDT by Dmitri Pal
Modified: 2017-10-02 17:31 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dmitri Pal 2017-08-07 08:51:34 EDT
Clevis UDisks2 support performs privileged operations on behalf of an unprivileged user. For the purposes of auditing, this privilege transition needs to be logged.

When this issue is addressed an audit event should show in the log as result of using clevis with a flash memory drive.
Comment 3 Nathaniel McCallum 2017-08-07 10:22:24 EDT
UDisks2 support currently logs messages to standard error for the purposes of debugging. However, we need to log all attempted key recoveries to the audit log since this recovery occurred on data obtained with elevated privileges.

Note You need to log in before you can comment on or make changes to this bug.