Hi Lakshmi,
On Fri, 2020-06-05 at 20:13 -0700, Lakshmi Ramasubramanian wrote:
> Hi Mimi,
>
> In integrity audit message function the inverse of "result" is being
> logged for "res=". Please see below. Is this intentional?
>
> void integrity_audit_msg(int audit_msgno, struct inode *inode,
> const unsigned char *fname, const char *op,
> const char *cause, int result, int audit_info)
> {
>
> ...
> audit_log_format(ab, " res=%d", !result);
> }
>
> The callers of this function are passing an error code (-ENOMEM,
> -EINVAL, etc.) in the "result" parameter. But that error code is lost -
> instead "res" is set to 0.
>
> For example,
>
> audit: type=1804 audit(1591411737.631:3): pid=1 uid=0 auid=4294967295
> ses=4294967295 subj=kernel op=ima_alloc_key_entry cause=ENOMEM
> comm="swapper/0" name=".builtin_trusted_keys" res=0
The commit message provides an explanation. Look at b0d5de4d5880 ("IMA: fix
audit res field to indicate 1 for success and 0 for failure").
Mimi
