STX: IMA appraisal for file execution still logged via 'fm event-list' every 20 minutes after the file is deleted

[Yang Liu]

Brief Description
-----------------
Create a new root file and delete it, IMA event in fm event-list is still generated every 20 minutes.
| 2018-10-17T15:31:39.721987 | log | 500.500 | Host controller-1 has IMA Appraisal failure for service /usr/bin/sudo when executing file /home/wrsroot/TEMP, reason = IMA-signature-required | host=controller-1.serv

Severity
--------
Minor

Steps to Reproduce
------------------
1. sudo touch /home/wrsroot/TEMP
2. sudo chmod 755 /home/wrsroot/TEMP
3. Append content to monitored file
echo "ls" | sudo -S tee -a /home/wrsroot/TEMP
4.Execute created file
sudo /home/wrsroot/TEMP
5. sudo rm /home/wrsroot/TEMP

Expected Behavior
------------------
4. Following event should be logged after executing the file
500.500 | Host controller-1 has IMA Appraisal failure for service /usr/bin/sudo when executing file /home/wrsroot/TEMP, reason = IMA-signature-required
5.a /var/log/ima.log no longer generates log for deleted file
5.b fm event-list no longer logs event for deleted file

Actual Behavior
----------------
4. as expected
5.a as expected
5.b The same IMA event is logged in fm event-list every 20 minutes even after deleting the file
----------------+----------+
| 2018-10-17T15:31:39.721987 | log | 500.500 | Host controller-1 has IMA Appraisal failure for service /usr/bin/sudo when executing file /home/wrsroot/TEMP, reason = IMA-signature-required | host=controller-1.service=sudo | major |
| 2018-10-17T15:11:39.729124 | log | 500.500 | Host controller-1 has IMA Appraisal failure for service /usr/bin/sudo when executing file /home/wrsroot/TEMP, reason = IMA-signature-required | host=controller-1.service=sudo | major |
| 2018-10-17T14:51:39.721386 | log | 500.500 | Host controller-1 has IMA Appraisal failure for service /usr/bin/sudo when executing file /home/wrsroot/TEMP, reason = IMA-signature-required | host=controller-1.service=sudo | major |

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Two node system

Branch/Pull Time/Commit
-----------------------
STX.18.10 "2018-10-16_01-52-00"

Timestamp/Logs
--------------
2018-10-17T14:51:39.721386 > expected event
2018-10-17T15:11:39.729124 > unexpected event after file deletion

[Ghada Khalil (gkhalil)]

This maybe expected behavior; assigning to the design prime to review/confirm.

[Ghada Khalil (gkhalil)]

From Paul-Emile:
I have reproduced the issue.

A single appraisal failure will produce a single entry in the /var/log/ima.log, but multiple entries in the /va/log/fm-event.log

When there are multiple appraisal failures, only the last entry is being repeated.

[Ghada Khalil (gkhalil)]

Targeting stx.2019.03 as best effort; lower priority as this is just a log getting repeated.

[Yong Fu (fuyong)]

I am using the 2019.06.26/06.23/06.20 version of the ISO, duplex mode, which does not reproduce the phenomenon you describe.
The operation is as follows:
0. Operate in controller-0 and controller-1 respectively.
1. sudo touch /home/sysadmin/TEMP
2. sudo chmod 755 /home/sysadmin /TEMP
3. Append content to monitored file
echo "ls" | sudo -S tee -a /home/sysadmin /TEMP
4. Execute created file
sudo /home/sysadmin /TEMP
5. sudo rm /home/sysadmin /TEMP

No IMA appraisal failure is logged in fm-event.log after deleting the file.
There is also no ima.log file in the /va/log/ directory.

Number of operations: 5 tests per version

I will try to use the 2018.10 version tomorrow to test if my steps are correct.

[Yong Fu (fuyong)]

I am using the 2018.10 version of the ISO, duplex mode and still have not reproduced this problem.

ISO URL: http://mirror.starlingx.cengn.ca/mirror/starlingx/r2018.10/centos/2018.10.0/outputs/iso/bootimage.iso

Installation process reference: https://docs.starlingx.io/deployment_guides/current/duplex.html

The upload date of this image is "13-Dec-2018 20:58".
Maybe the problem has been fixed at this time.
In short, I can't reproduce it according to the steps of the Bug Description.
If the steps of the Bug Description is not wrong, I think this error has been fixed.
Maybe we should close this bug

[Cindy Xie (xxie1)]

OK, let me mark it as "fix released" for now. And if bug reporter found it reproducible, please re-open it.

[Ghada Khalil (gkhalil)]

Cindy, we only use "Fix Released" if we definitively know that there is a code fix that addressed the issue. This doesn't seem to be the case here. The comments above only indicate that the issue is not reproducible. In this case, we have been using the "Invalid" status since there is "no reproducible" status in launchpad.

[Yang Liu (yliu12)]

Original issue only happens with extended security profile (as opposed to the default standard security) when IMA is enabled.

However, I'm closing it because extended security profile is being dropped.