Re: [PATCH v3] IMA: Add audit log for failure conditions

> The number in parenthesis is the error code (such as ENOMEM, EINVAL, > etc.) IMA uses this format for reporting TPM errors in one of the audit > messages (In ima_add_template_entry()). I followed the same pattern. > > Would it be better if the value for "cause" is formatted as > > cause=hashing_error_-22 > > cause=alloc_entry_-12 Neither fit the name=value style that all other events follow. What would fit the style is something like this: cause=hashing_error errno=-22 cause=alloc_entry errno=-12 Would this be OK? Also, errno is only to illustrate. You can name it something else as long as there are no use case collisions with our dictionary of field names. https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/ field-dictionary.csv