Bug 428274 - Audit messages need distinct types
Summary: Audit messages need distinct types
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: nss
Version: 11
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Bob Relyea
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-01-10 13:19 UTC by Steve Grubb
Modified: 2010-06-28 10:31 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-06-28 10:31:23 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Mozilla Foundation 426413 0 None None None Never

Description Steve Grubb 2008-01-10 13:19:50 UTC
Description of problem:
All the audit messages related to FIPS are using audit message type AUDIT_USER
which has a value of 1005. From /usr/include/linux/audit.h, the range 2400 -
2499 is reserved for user space crypto events.

We need to define the types of events that NSS is reporting and change the code
to use the correct audit message types preferably during F9 development.

Comment 1 Bob Relyea 2008-04-01 21:01:33 UTC
Hi Steve,

Are there any definitions for the values in that range, or are we free to pick
whatever we want. Also, should we pick a single AUDIT_NSS or should we have
separate entries for the various NSS AUDIT events?

bob

Comment 2 Steve Grubb 2008-04-03 15:57:23 UTC
Hi Bob,

What I'd like to do is first identify the major kinds of things that have to be
logged and create event types for that. So, this is something where we are more
or less free to choose, but it has to be coordinated between audit and nss. Do
the events fall into general categories about what is being conveyed in the
audited events?

Comment 3 Bob Relyea 2008-04-03 17:08:14 UTC
Currently all the events are rolled up under 'user events' and have the string
"NSS SOFTOKEN".

We log entry into the following functions:
CreateObject
CopyObject
DestroyObject
GetObjectSize
GetAttributeValue
SetAttributeValue
CryptInit (EncryptInit/DecryptInit/SignInit/VerifyInit/VerifyRecoverInit)
GenerateKey
GenerateKeyPair
WrapKey
UnwrapKey
DeriveKey
DigestKey
InitToken
InitPin
SetPin
Login
Logout

We also log the following errors specifically:
power-on-selftest failed (C_Initialize)
rng test failure (C_GenerateRandom)
pairwise consistancy check failed (C_GenerateKeyPair)


I log 2 'severity' of events, AUDIT_INFO and AUDIT_ERROR. The 3 errors above are
all AUDIT_ERROR. The logged entries are AUDIT_INFO if the operation succeeded
and AUDIT_ERROR if they failed.




Comment 4 Bob Relyea 2008-04-03 17:12:52 UTC
I think the choices we have include:

1) a single NSS_SOFTOKEN Audit category.
2) 2 softoken Audit categories (INFO and ERROR).
3) break the NSS functions into categories and provide audit categories for each
of those general NSS categories (PIN, Key, Operation, management)*
4) provide audit categories for each of the entry points.

I would be inclined towards options 1 or 2, possibly 3.

(* these categories, I just made up in the last 30 seconds so they are for
examples only, not necessarily the categories we would use).


Comment 5 Steve Grubb 2008-04-03 17:50:29 UTC
I have a feeling that auditing all those functions is not necessary - unless you
have a way of letting the crypto officer set the level of audit detail by some
config parameter. But, you do have some things like: power-on-self-test,
rng-test, & maybe pairwise consistency check depending on what that is.

Things I'm looking at are like: changing any critical parameter of the crypto
system like selection of algorithm or key length by the crypto officer, replay
detection, log in to crypto officer role, key
creation/distribution/handling/negotiation, failure
decrypting/encrypting/hashing/signature. There might be a couple others.

Comment 6 Bug Zapper 2008-05-14 04:22:13 UTC
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 7 Steve Grubb 2009-01-08 21:19:02 UTC
Moving this back to rawhide since the problem is still there. We still need to come to a consensus as to what types are needed. The types should reflect the major events that are called out in MLOSPP or FIPS-140. Each major event should should have 1 audit record with all details in it. It should not be at a function call trace level of detail.

Events I'm considering are something like: CRYPTO_TEST, CRYPTO_PARAM_CHANGE, CRYPTO_REPLAY, CRYPTO_LOGIN, CRYPTO_LOGOUT, CRYPTO_KEY, and CRYPTO_FAILURE. Would there be anything that does not fit into these? Thanks.

Comment 8 Bob Relyea 2009-01-08 22:18:57 UTC
I can live with those. For FIPS reasons we need to log each and every entry into the module that can muck with a CSP. Most have to deal with keys,
so I can map

CreateObject
CopyObject
DestroyObject
GetObjectSize
GetAttributeValue
CryptInit (EncryptInit/DecryptInit/SignInit/VerifyInit/VerifyRecoverInit)
GenerateKey
GenerateKeyPair
WrapKey
UnwrapKey
DeriveKey
DigestKey

To CRYPTO_KEY (Not all these operations necessarily deal with keys, but only the key versions are logged).

SetAttributeValue

To CRYPTO_PARAM_CHANGE or CRYPTO_KEY

InitToken
InitPin
SetPin

To CRYPTO_PARAM_CHANGE

Login to CRYPTO_LOGIN
Logout to CRYPTO_LOGIN

power-on-selftest failed (C_Initialize)
rng test failure (C_GenerateRandom)
pairwise consistancy check failed (C_GenerateKeyPair)

Probably map to CRYPTO_FAILURE.

They could also map as follows

power-on-selftest fail CRYPTO_TEST, type=ERROR
rng test failure CRYPTO_TEST or CRYPTO_FAIL type=ERROR
pairwise consistancy check failed CRYPTO_KEY type=ERROR

bob

Comment 9 Steve Grubb 2009-01-13 19:33:08 UTC
OK, I agree with the mapping of CRYPTO_KEY, but what we should do is have a field op=xxx that describes what is happening at at higher level. IOW, creation,destruction,negotiation,etc.

CRYPTO_PARAM_CHANGE would be intended for setting a key size, setting preferred algorithms, etc. It should have both the old and new value. So, mapping SetAttributeValue to it is likely the right thing.

The next set, InitTokem through SetPin probably all don't map to the same one. If they are involved in key creation, then CRYPTO_KEY is probably the right choice.

Login/out would map to CRYPTO_LOGIN with perhaps an op=xxx field giving one word, in or out to distinguish the two.

The tests would map to CRYPTO_TESTS with the res field showing 1 success and 0 failure.

CRYPTO_FAILURE would be used whenever there was a failure in decrypting, encrypting, hashing, signing, or the randomization process.

These categories are derived from Table 5.2 of the Medium Robustness Protection Profile (PP_OS_ML_MR2.0_V1.91.pdf), page 42 & 44. Note that MR encompasses FIPS level 2 and higher and only calls out for audit in failures of certain things and all events for a small selection (changes in attributes & self tests).

Hope this helps.

Comment 10 Steve Grubb 2009-01-13 22:59:09 UTC
audit package 1.7.11-2 was built with the CRYPTO events added. Its in rawhide and F-10.

Comment 11 Bug Zapper 2009-06-09 09:25:10 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 12 Bug Zapper 2010-04-27 11:52:40 UTC
This message is a reminder that Fedora 11 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 11.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '11'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 11's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 11 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 13 Bug Zapper 2010-06-28 10:31:23 UTC
Fedora 11 changed to end-of-life (EOL) status on 2010-06-25. Fedora 11 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.