Commit 2f845882ecd2 ("integrity: Add errno field in audit message")
introduced an audit log function that can take an error code. It is
wrapped by integrity_audit_msg() that implicitly sets the error code
argument to zero. The problem is that there are uses of integrity_audit_msg()
such as ima_collect_measurement() that hide the failure cause for
the message.
This series aims to clarify error reasons for failures, and then expose
error codes based on the following criteria:
1. The log depends on a result from earlier callee, and/or
2. The caller function itself returns with that result
ima_release_policy() is the only caller I thought made sense to keep as
is. The message doesn't correlate with a return code, nor does it
depend on a result from an earlier callee in the function.
Signed-off-by: Frederick Lawler <[email protected]>
---
Changes in v3:
- Condense series to two commits.
- Reduce review churn by adding error code to integrity_audit_msg().
- ima_write_policy() to report -EINVAL instead of result.
- Link to v2:
https://lore.kernel.org/r/[email protected]
Changes in v2:
- Changes from v1 are now reflected in patch 3.
- Replace all instances of integrity_audit_msg().
- Convert to patch series.
- Link to v1:
https://lore.kernel.org/r/[email protected]
---
Frederick Lawler (2):
integrity: Report error code in integrity_audit_msg() call sites
integrity: Replace integrity_audit_message() with integrity_audit_msg()
security/integrity/evm/evm_main.c | 9 +++++----
security/integrity/ima/ima_api.c | 8 ++++----
security/integrity/ima/ima_appraise.c | 6 +++---
security/integrity/ima/ima_fs.c | 4 ++--
security/integrity/ima/ima_init.c | 2 +-
security/integrity/ima/ima_main.c | 13 +++++++------
security/integrity/ima/ima_policy.c | 11 ++++++-----
security/integrity/ima/ima_queue.c | 2 +-
security/integrity/ima/ima_queue_keys.c | 8 ++++----
security/integrity/ima/ima_template_lib.c | 2 +-
security/integrity/integrity.h | 18 +++---------------
security/integrity/integrity_audit.c | 12 ++----------
12 files changed, 39 insertions(+), 56 deletions(-)
---
base-commit: 6903878d4654bdef4e08e38cdf1ae306ce7de5f9
change-id: 20260716-report-hash-error-5203d6fe6e4e
Best regards,
--
Frederick Lawler <[email protected]>
