On 6/9/20 9:43 AM, Steve Grubb wrote:
The number in parenthesis is the error code (such as ENOMEM, EINVAL,
etc.) IMA uses this format for reporting TPM errors in one of the audit
messages (In ima_add_template_entry()). I followed the same pattern.
Would it be better if the value for "cause" is formatted as
cause=hashing_error_-22
cause=alloc_entry_-12
Neither fit the name=value style that all other events follow. What would fit
the style is something like this:
cause=hashing_error errno=-22
cause=alloc_entry errno=-12
Would this be OK? Also, errno is only to illustrate. You can name it
something else as long as there are no use case collisions with our
dictionary of field names.
https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/
field-dictionary.csv
I am fine with this.
"errno" is currently not listed in the dictionary of audit message field
names (Thanks for the pointer to this one Steve)
Mimi - please let me know if you have any concerns with adding the
"result" code in "errno" field in integrity_audit_msg().
Sample message:
[ 8.051937] audit: type=1804 audit(1591633422.365:8): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
op=measuring_keys cause=hashing_error errno=-22 comm="systemd"
name=".builtin_trusted_keys" res=0
thanks,
-lakshmi
