Re: [PATCH v3] IMA: Add audit log for failure conditions

On 6/9/20 9:43 AM, Steve Grubb wrote: > > The number in parenthesis is the error code (such as ENOMEM, EINVAL, > > etc.) IMA uses this format for reporting TPM errors in one of the audit > > messages (In ima_add_template_entry()). I followed the same pattern. > > > > Would it be better if the value for "cause" is formatted as > > > > cause=hashing_error_-22 > > > > cause=alloc_entry_-12 > > Neither fit the name=value style that all other events follow. What would fit > the style is something like this: > > cause=hashing_error errno=-22 > cause=alloc_entry errno=-12 > > Would this be OK? Also, errno is only to illustrate. You can name it > something else as long as there are no use case collisions with our > dictionary of field names. > > https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/ > field-dictionary.csv I am fine with this. "errno" is currently not listed in the dictionary of audit message field names (Thanks for the pointer to this one Steve) Mimi - please let me know if you have any concerns with adding the "result" code in "errno" field in integrity_audit_msg().

Sample message: [ 8.051937] audit: type=1804 audit(1591633422.365:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 op=measuring_keys cause=hashing_error errno=-22 comm="systemd" name=".builtin_trusted_keys" res=0 thanks, -lakshmi