Bug 1478888 - Clevis should log privileged operations
Clevis should log privileged operations
Status: VERIFIED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: clevis (Show other bugs)
7.4
Unspecified Unspecified
high Severity medium
: rc
: ---
Assigned To: Nathaniel McCallum
Jiri Jaburek
Mirek Jahoda
:
Depends On: 1507653
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-07 08:51 EDT by Dmitri Pal
Modified: 2018-01-08 10:48 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
_clevis_ now logs privileged operations With this update, the _clevis-udisks2_ subpackage logs all attempted key recoveries to the Audit log, and the privileged operations can be now tracked using the Linux Audit system.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dmitri Pal 2017-08-07 08:51:34 EDT
Clevis UDisks2 support performs privileged operations on behalf of an unprivileged user. For the purposes of auditing, this privilege transition needs to be logged.

When this issue is addressed an audit event should show in the log as result of using clevis with a flash memory drive.
Comment 3 Nathaniel McCallum 2017-08-07 10:22:24 EDT
UDisks2 support currently logs messages to standard error for the purposes of debugging. However, we need to log all attempted key recoveries to the audit log since this recovery occurred on data obtained with elevated privileges.
Comment 16 Nathaniel McCallum 2018-01-08 10:25:46 EST
Clarification: clevis-udisks2 does logging. Not the entire framework.

Note You need to log in before you can comment on or make changes to this bug.