Commit 2f845882ecd2 ("integrity: Add errno field in audit message")
introduced an audit log function that can take an error code. It is
wrapped by integrity_audit_msg() that implicitly sets the error code
argument to zero. The problem is that there are uses of integrity_audit_msg()
such as ima_collect_measurement() that hide the failure cause for
the message.
This series aims to convert integrity_audit_msg() call sites to
integrity_audit_message(), and then expose error codes based on the
following criteria:
1. The log depends on a result from earlier callee, and/or
2. The caller function itself returns with that result
ima_release_policy() is the only caller I thought made sense to keep as
is. The message doesn't correlate with a return code, nor does it
depend on a result from an earlier callee in the function.
Signed-off-by: Frederick Lawler <[email protected]>
---
This is probably a bit more than what was asked from v1, but as I was
making changes and looking at other call sites, I didn't think it made
sense to keep integrity_audit_msg() around anymore.
Changes in v2:
- Changes from v1 are now reflected in patch 3.
- Replace all instances of integrity_audit_msg().
- Convert to patch series.
- Link to v1:
https://lore.kernel.org/r/[email protected]
---
Frederick Lawler (3):
integrity: Replace all uses of integrity_audit_msg() with
integrity_audit_message()
integrity: Remove integrity_audit_msg()
integrity: Report error code in integrity_audit_message() call sites
security/integrity/evm/evm_main.c | 38 ++++++++++++++++++-------------
security/integrity/ima/ima_api.c | 20 ++++++++--------
security/integrity/ima/ima_appraise.c | 12 +++++-----
security/integrity/ima/ima_fs.c | 11 +++++----
security/integrity/ima/ima_init.c | 4 ++--
security/integrity/ima/ima_main.c | 16 +++++++------
security/integrity/ima/ima_policy.c | 25 ++++++++++----------
security/integrity/ima/ima_queue.c | 4 ++--
security/integrity/ima/ima_template_lib.c | 6 ++---
security/integrity/integrity.h | 11 ---------
security/integrity/integrity_audit.c | 8 -------
11 files changed, 73 insertions(+), 82 deletions(-)
---
base-commit: 1da739feb31b4fecae465ebf87ba44a97e44101b
change-id: 20260716-report-hash-error-5203d6fe6e4e
Best regards,
--
Frederick Lawler <[email protected]>
