From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=/zAK=76=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no
	version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 62260C433E0
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 20:55:25 +0000 (UTC)
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id 0ED852073E
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 20:55:24 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OgOlVgS0"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0ED852073E
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592427323;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=W14OJ4cQx+F1Zhq7rU8K/Sml32iYWga+sYIFhtI2rdE=;
	b=OgOlVgS028Ov6KgFgYhM7zG2uI7qBi/BBn7Q7ZD08q75gkg4wb1e2/vp9JVblHZSZBzAkF
	SXsHc5x426OJT02YnWl+vKguTeQfS4lVJTcRwW7jfDB2dfCBNKVhwjt0SuWwwQlrBc+grg
	WD3qeF+5sMljpQF4cyQEC5K2up8tXgI=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-175-3dlCVwZQNguLpruhfZEiFQ-1; Wed, 17 Jun 2020 16:55:18 -0400
X-MC-Unique: 3dlCVwZQNguLpruhfZEiFQ-1
Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 09C958BF480;
	Wed, 17 Jun 2020 20:55:15 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id D1E387CAA5;
	Wed, 17 Jun 2020 20:55:14 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 6C9561809547;
	Wed, 17 Jun 2020 20:55:14 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com
	[10.11.54.4])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05HKitss030822 for <linux-audit@listman.util.phx.redhat.com>;
	Wed, 17 Jun 2020 16:44:55 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id 36CEA2026E04; Wed, 17 Jun 2020 20:44:55 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 329A22028DCC
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 20:44:49 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com
	[207.211.31.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7DFA3108C267
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 20:44:49 +0000 (UTC)
Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by
	relay.mimecast.com with ESMTP id us-mta-379-F9bLzZNoPQWAeD-FTRXc5g-1;
	Wed, 17 Jun 2020 16:44:42 -0400
X-MC-Unique: F9bLzZNoPQWAeD-FTRXc5g-1
Received: from localhost.localdomain (c-73-42-176-67.hsd1.wa.comcast.net
	[73.42.176.67])
	by linux.microsoft.com (Postfix) with ESMTPSA id B038B20B711C;
	Wed, 17 Jun 2020 13:44:41 -0700 (PDT)
DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com B038B20B711C
From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: zohar@linux.ibm.com, bauerman@linux.ibm.com, nayna@linux.ibm.com,
	sgrubb@redhat.com, paul@paul-moore.com
Subject: [PATCH 2/2] integrity: Add errno field in audit message
Date: Wed, 17 Jun 2020 13:44:36 -0700
Message-Id: <20200617204436.2226-2-nramas@linux.microsoft.com>
In-Reply-To: <20200617204436.2226-1-nramas@linux.microsoft.com>
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4
X-MIME-Autoconverted: from quoted-printable to 8bit by
	lists01.pubmisc.prod.ext.phx2.redhat.com id 05HKitss030822
X-loop: linux-audit@redhat.com
X-Mailman-Approved-At: Wed, 17 Jun 2020 16:55:12 -0400
Cc: rgb@redhat.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Error code is not included in the audit messages logged by
the integrity subsystem. Add "errno" field in the audit messages
logged by the integrity subsystem and set the value to the error code
passed to integrity_audit_msg() in the "result" parameter.

Sample audit messages:

[    6.284329] audit: type=1804 audit(1591756723.627:2): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel op=add_boot_aggregate cause=alloc_entry comm="swapper/0" name="boot_aggregate" res=0 errno=-12

[    8.085456] audit: type=1802 audit(1592005947.297:9): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 op=policy_update cause=completed comm="systemd" res=1 errno=0

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Suggested-by: Steve Grubb <sgrubb@redhat.com>
---
 security/integrity/integrity_audit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
index 5109173839cc..a265024f82f3 100644
--- a/security/integrity/integrity_audit.c
+++ b/security/integrity/integrity_audit.c
@@ -53,6 +53,6 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
 		audit_log_untrustedstring(ab, inode->i_sb->s_id);
 		audit_log_format(ab, " ino=%lu", inode->i_ino);
 	}
-	audit_log_format(ab, " res=%d", !result);
+	audit_log_format(ab, " res=%d errno=%d", !result, result);
 	audit_log_end(ab);
 }
-- 
2.27.0


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=/zAK=76=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY
	autolearn=unavailable autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 00455C433DF
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 20:56:45 +0000 (UTC)
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id A5CDE2168B
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 20:56:44 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ju0nEAqg"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A5CDE2168B
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592427403;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=oQsk0H+8gu5JWeO5wpu3Kmv2bfgW2z45sdXdyc/8jw8=;
	b=Ju0nEAqgQlv180m8pq22Egvk4Anzl1vvI1JVHDFRQr6YWS9/49R0nEARVVv4yJpzcLjjwI
	wacC79WlLdXgTF4scFiuIDnqMuaBHuqTc+/2xLO3UK8XB6jpGE8qt/YcRyHlZFt480Cqze
	Ier9KEDy+5MIx7moUUnlXFCvTdRtr9U=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-463-rwKB0pTHMaSuqTYqjh1c1A-1; Wed, 17 Jun 2020 16:56:42 -0400
X-MC-Unique: rwKB0pTHMaSuqTYqjh1c1A-1
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id AB8698014D4;
	Wed, 17 Jun 2020 20:56:38 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 877205D9E4;
	Wed, 17 Jun 2020 20:56:38 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 3678D1809547;
	Wed, 17 Jun 2020 20:56:38 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com
	[10.11.54.6])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05HKiqu6030809 for <linux-audit@listman.util.phx.redhat.com>;
	Wed, 17 Jun 2020 16:44:53 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id CA59A2156A2E; Wed, 17 Jun 2020 20:44:52 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id C4C6D2157F26
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 20:44:50 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id EDE028007CB
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 20:44:49 +0000 (UTC)
Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by
	relay.mimecast.com with ESMTP id us-mta-347-gmpHsf7POa-9Gp0xfg9dWQ-1;
	Wed, 17 Jun 2020 16:44:42 -0400
X-MC-Unique: gmpHsf7POa-9Gp0xfg9dWQ-1
Received: from localhost.localdomain (c-73-42-176-67.hsd1.wa.comcast.net
	[73.42.176.67])
	by linux.microsoft.com (Postfix) with ESMTPSA id 682C020B7192;
	Wed, 17 Jun 2020 13:44:41 -0700 (PDT)
DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 682C020B7192
From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: zohar@linux.ibm.com, bauerman@linux.ibm.com, nayna@linux.ibm.com,
	sgrubb@redhat.com, paul@paul-moore.com
Subject: [PATCH 1/2] IMA: pass error code in result parameter to
	integrity_audit_msg()
Date: Wed, 17 Jun 2020 13:44:35 -0700
Message-Id: <20200617204436.2226-1-nramas@linux.microsoft.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6
X-MIME-Autoconverted: from quoted-printable to 8bit by
	lists01.pubmisc.prod.ext.phx2.redhat.com id 05HKiqu6030809
X-loop: linux-audit@redhat.com
X-Mailman-Approved-At: Wed, 17 Jun 2020 16:55:12 -0400
Cc: rgb@redhat.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

The value passed in "result" parameter to integrity_audit_msg() is
not an error code in some instances. Update these instances so that
"result" parameter always contains an error code.

Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
 security/integrity/ima/ima_appraise.c | 20 ++++++++++++--------
 security/integrity/ima/ima_fs.c       |  8 +++++---
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index a9649b04b9f1..253dcb331249 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -226,7 +226,7 @@ static int xattr_verify(enum ima_hooks func, struct integrity_iint_cache *iint,
 		}
 		clear_bit(IMA_DIGSIG, &iint->atomic_flags);
 		if (xattr_len - sizeof(xattr_value->type) - hash_start >=
-				iint->ima_hash->length)
+				iint->ima_hash->length) {
 			/*
 			 * xattr length may be longer. md5 hash in previous
 			 * version occupied 20 bytes in xattr, instead of 16
@@ -234,6 +234,9 @@ static int xattr_verify(enum ima_hooks func, struct integrity_iint_cache *iint,
 			rc = memcmp(&xattr_value->data[hash_start],
 				    iint->ima_hash->digest,
 				    iint->ima_hash->length);
+			if (rc)
+				rc = -EINVAL;
+		}
 		else
 			rc = -EINVAL;
 		if (rc) {
@@ -355,7 +358,7 @@ int ima_appraise_measurement(enum ima_hooks func,
 	struct dentry *dentry = file_dentry(file);
 	struct inode *inode = d_backing_inode(dentry);
 	enum integrity_status status = INTEGRITY_UNKNOWN;
-	int rc = xattr_len;
+	int rc = -EACCES;
 	bool try_modsig = iint->flags & IMA_MODSIG_ALLOWED && modsig;
 
 	/* If not appraising a modsig, we need an xattr. */
@@ -363,10 +366,7 @@ int ima_appraise_measurement(enum ima_hooks func,
 		return INTEGRITY_UNKNOWN;
 
 	/* If reading the xattr failed and there's no modsig, error out. */
-	if (rc <= 0 && !try_modsig) {
-		if (rc && rc != -ENODATA)
-			goto out;
-
+	if (xattr_len <= 0 && !try_modsig) {
 		cause = iint->flags & IMA_DIGSIG_REQUIRED ?
 				"IMA-signature-required" : "missing-hash";
 		status = INTEGRITY_NOLABEL;
@@ -379,7 +379,8 @@ int ima_appraise_measurement(enum ima_hooks func,
 		goto out;
 	}
 
-	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
+	status = evm_verifyxattr(dentry, XATTR_NAME_IMA,
+				 xattr_value, xattr_len, iint);
 	switch (status) {
 	case INTEGRITY_PASS:
 	case INTEGRITY_PASS_IMMUTABLE:
@@ -432,14 +433,17 @@ int ima_appraise_measurement(enum ima_hooks func,
 		if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
 		    (!xattr_value ||
 		     xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
-			if (!ima_fix_xattr(dentry, iint))
+			if (!ima_fix_xattr(dentry, iint)) {
 				status = INTEGRITY_PASS;
+				rc = 0;
+			}
 		}
 
 		/* Permit new files with file signatures, but without data. */
 		if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&
 		    xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) {
 			status = INTEGRITY_PASS;
+			rc = 0;
 		}
 
 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index e3fcad871861..a3a270cff94f 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -335,10 +335,10 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
 		result = ima_read_policy(data);
 	} else if (ima_appraise & IMA_APPRAISE_POLICY) {
 		pr_err("signed policy file (specified as an absolute pathname) required\n");
+		result = -EACCES;
 		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
 				    "policy_update", "signed policy required",
-				    1, 0);
-		result = -EACCES;
+				    result, 0);
 	} else {
 		result = ima_parse_add_rule(data);
 	}
@@ -406,6 +406,7 @@ static int ima_open_policy(struct inode *inode, struct file *filp)
 static int ima_release_policy(struct inode *inode, struct file *file)
 {
 	const char *cause = valid_policy ? "completed" : "failed";
+	int result = 0;
 
 	if ((file->f_flags & O_ACCMODE) == O_RDONLY)
 		return seq_release(inode, file);
@@ -413,11 +414,12 @@ static int ima_release_policy(struct inode *inode, struct file *file)
 	if (valid_policy && ima_check_policy() < 0) {
 		cause = "failed";
 		valid_policy = 0;
+		result = -EINVAL;
 	}
 
 	pr_info("policy update %s\n", cause);
 	integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
-			    "policy_update", cause, !valid_policy, 0);
+			    "policy_update", cause, result, 0);
 
 	if (!valid_policy) {
 		ima_delete_rules();
-- 
2.27.0


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=/zAK=76=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no
	version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 94E18C433DF
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 21:15:50 +0000 (UTC)
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id 3BFA12186A
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 21:15:50 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Rlvbhb1Z"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3BFA12186A
Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=paul-moore.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592428549;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=bt29Vftx/nUC0iBuLJGOn1RCNe9L2pPpJEuzQha6t00=;
	b=Rlvbhb1ZCrNmbfAGzRVBl+pwZtcJluQUV0cEWKQAC8dwo7IadtkGwI0AwDBEt1CqIwh6a7
	pMEHXejCwR6VCZvsyQsn6WC4s9TvQet0BRFWygoWaP94ahkV0HDc4VpBvTK/gvflol+bsN
	pDQKbhajzIwr9lxKp6lddeannp7CfNc=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-105-zX03hITKNnedtyKpbMbViA-1; Wed, 17 Jun 2020 17:15:40 -0400
X-MC-Unique: zX03hITKNnedtyKpbMbViA-1
Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 00B341005513;
	Wed, 17 Jun 2020 21:15:37 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 761B379318;
	Wed, 17 Jun 2020 21:15:36 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 2DFCB1809547;
	Wed, 17 Jun 2020 21:15:35 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com
	[10.11.54.5])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05HLFXKb004003 for <linux-audit@listman.util.phx.redhat.com>;
	Wed, 17 Jun 2020 17:15:33 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id 65887F1019; Wed, 17 Jun 2020 21:15:33 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 61BCDF101F
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 21:15:31 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0508F8007B3
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 21:15:31 +0000 (UTC)
Received: from mail-ej1-f67.google.com (mail-ej1-f67.google.com
	[209.85.218.67]) (Using TLS) by relay.mimecast.com with ESMTP id
	us-mta-387-BHnx-w34NsKRmvCwdxyUsw-1; Wed, 17 Jun 2020 17:15:26 -0400
X-MC-Unique: BHnx-w34NsKRmvCwdxyUsw-1
Received: by mail-ej1-f67.google.com with SMTP id mb16so4141042ejb.4
	for <linux-audit@redhat.com>; Wed, 17 Jun 2020 14:15:26 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20161025;
	h=x-gm-message-state:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:cc;
	bh=aF2QFHszBUveBEYuZ4El0wMTZ2oyuOvfLY0YCwJErgY=;
	b=KSv4e2KNKfF1kTiK5DvW6QV4dKKDoORuZHb58AHuQZoJD8v8YdR0GpDlrO5nrvNmft
	qiaNE0fhSNMMhTaTxcLsNffFQJTQSdr1i+UJnbf4edV7SPjjDZrfKUQXXEGWqVAPcBfk
	I7vwnf9fUkZOCj5uyNFqAP/kYmfX+8uWkAsqh+Z7k6awRmJan0qMEoTTqegemSFEed/Y
	lw2bjyb/tzIaLrZ0sbFNh4Zx69ge0D8y09kEJEMzgC7NEABGGMC+oKzYfAIyRMrfTrI3
	2E5XQp/btU9OlK7TRYQnJxlnhh6GxlVxsX3UenLuQBl636njUEzoMJLGM8uSlGq9qTf2
	/m3A==
X-Gm-Message-State: AOAM530CW7dKdaC2xVV2YZJoNlvyeIWMs0JmAJCpOAdsEpyer7a0pWSz
	4DzJUmrHm6Uk3Oj6wSe0e83k+churAvKfKq1S1+HLdU=
X-Google-Smtp-Source: ABdhPJwpQGCuUs9iFPAHM5LwSxMut1A4ihpgUz0qV9wJycHjByfPFJfNofYDt/VmT8F/+Bwr1wIS1cgTIhYY6STDwXU=
X-Received: by 2002:a17:906:ecef:: with SMTP id
	qt15mr1003538ejb.91.1592428525325; 
	Wed, 17 Jun 2020 14:15:25 -0700 (PDT)
MIME-Version: 1.0
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
	<20200617204436.2226-2-nramas@linux.microsoft.com>
In-Reply-To: <20200617204436.2226-2-nramas@linux.microsoft.com>
From: Paul Moore <paul@paul-moore.com>
Date: Wed, 17 Jun 2020 17:15:14 -0400
Message-ID: <CAHC9VhTUd1N_W3Axr4PRt2qe56YfxeRiX17hqTnGJrJPVYNRWw@mail.gmail.com>
Subject: Re: [PATCH 2/2] integrity: Add errno field in audit message
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5
X-loop: linux-audit@redhat.com
Cc: rgb@redhat.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org,
	zohar@linux.ibm.com, linux-audit@redhat.com,
	linux-integrity@vger.kernel.org, bauerman@linux.ibm.com
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

On Wed, Jun 17, 2020 at 4:44 PM Lakshmi Ramasubramanian
<nramas@linux.microsoft.com> wrote:
>
> Error code is not included in the audit messages logged by
> the integrity subsystem. Add "errno" field in the audit messages
> logged by the integrity subsystem and set the value to the error code
> passed to integrity_audit_msg() in the "result" parameter.
>
> Sample audit messages:
>
> [    6.284329] audit: type=1804 audit(1591756723.627:2): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel op=add_boot_aggregate cause=alloc_entry comm="swapper/0" name="boot_aggregate" res=0 errno=-12
>
> [    8.085456] audit: type=1802 audit(1592005947.297:9): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 op=policy_update cause=completed comm="systemd" res=1 errno=0
>
> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> ---
>  security/integrity/integrity_audit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Acked-by: Paul Moore <paul@paul-moore.com>

> diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
> index 5109173839cc..a265024f82f3 100644
> --- a/security/integrity/integrity_audit.c
> +++ b/security/integrity/integrity_audit.c
> @@ -53,6 +53,6 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
>                 audit_log_untrustedstring(ab, inode->i_sb->s_id);
>                 audit_log_format(ab, " ino=%lu", inode->i_ino);
>         }
> -       audit_log_format(ab, " res=%d", !result);
> +       audit_log_format(ab, " res=%d errno=%d", !result, result);
>         audit_log_end(ab);
>  }
> --
> 2.27.0

-- 
paul moore
www.paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=/zAK=76=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,
	MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham
	autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id C657FC433DF
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 22:37:01 +0000 (UTC)
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id 3BAFE20810
	for <linux-audit@archiver.kernel.org>; Wed, 17 Jun 2020 22:37:00 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FyygLAi5"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3BAFE20810
Authentication-Results: mail.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592433420;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=R75dL/WuDPPqg1hmSDNmQ0x30n3bacEkPdNTjXIRzs0=;
	b=FyygLAi5VSc3vcdVW4Nw8odNtBvF5xulYw/pk7QghU0I5Rlbq/c8JFOADfWIw7kkDnc5y6
	TSoBh1mk+dSjR/vewRmzHi1TaPw4p14t8qOer3buUn3G0U2yBDWryBQAVpJ6iawyWqzVyS
	IA/i2P+LaGdMCdVDM26ix2bX7n9FNhY=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-217-moKdDEwJOeqetb1KVbTC-A-1; Wed, 17 Jun 2020 18:36:57 -0400
X-MC-Unique: moKdDEwJOeqetb1KVbTC-A-1
Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id B51AD100CCC0;
	Wed, 17 Jun 2020 22:36:53 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 0431519931;
	Wed, 17 Jun 2020 22:36:53 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id D7AE0833C6;
	Wed, 17 Jun 2020 22:36:51 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com
	[10.5.11.23])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05HMaoHL013820 for <linux-audit@listman.util.phx.redhat.com>;
	Wed, 17 Jun 2020 18:36:50 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id 1FFA419932; Wed, 17 Jun 2020 22:36:50 +0000 (UTC)
Received: from x2.localnet (ovpn-114-52.phx2.redhat.com [10.3.114.52])
	by smtp.corp.redhat.com (Postfix) with ESMTP id D25BD19931;
	Wed, 17 Jun 2020 22:36:43 +0000 (UTC)
From: Steve Grubb <sgrubb@redhat.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Subject: Re: [PATCH 2/2] integrity: Add errno field in audit message
Date: Wed, 17 Jun 2020 18:36:43 -0400
Message-ID: <3369897.H5lpGJDj0b@x2>
Organization: Red Hat
In-Reply-To: <20200617204436.2226-2-nramas@linux.microsoft.com>
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
	<20200617204436.2226-2-nramas@linux.microsoft.com>
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23
X-loop: linux-audit@redhat.com
Cc: rgb@redhat.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org,
	zohar@linux.ibm.com, linux-audit@redhat.com,
	linux-integrity@vger.kernel.org, bauerman@linux.ibm.com
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

On Wednesday, June 17, 2020 4:44:36 PM EDT Lakshmi Ramasubramanian wrote:
> Error code is not included in the audit messages logged by
> the integrity subsystem. Add "errno" field in the audit messages
> logged by the integrity subsystem and set the value to the error code
> passed to integrity_audit_msg() in the "result" parameter.
> 
> Sample audit messages:
> 
> [    6.284329] audit: type=1804 audit(1591756723.627:2): pid=1 uid=0
> auid=4294967295 ses=4294967295 subj=kernel op=add_boot_aggregate
> cause=alloc_entry comm="swapper/0" name="boot_aggregate" res=0 errno=-12
> 
> [    8.085456] audit: type=1802 audit(1592005947.297:9): pid=1 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
> op=policy_update cause=completed comm="systemd" res=1 errno=0
> 
> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>

Acked-by: Steve Grubb <sgrubb@redhat.com>

> ---
>  security/integrity/integrity_audit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/integrity/integrity_audit.c
> b/security/integrity/integrity_audit.c index 5109173839cc..a265024f82f3
> 100644
> --- a/security/integrity/integrity_audit.c
> +++ b/security/integrity/integrity_audit.c
> @@ -53,6 +53,6 @@ void integrity_audit_msg(int audit_msgno, struct inode
> *inode, audit_log_untrustedstring(ab, inode->i_sb->s_id);
>  		audit_log_format(ab, " ino=%lu", inode->i_ino);
>  	}
> -	audit_log_format(ab, " res=%d", !result);
> +	audit_log_format(ab, " res=%d errno=%d", !result, result);
>  	audit_log_end(ab);
>  }




--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=mQOg=77=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.3 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 041BBC433E0
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:28 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id 5BEB420C09
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:27 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="aiWz6L9Z"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5BEB420C09
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592508266;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=G2fyzUtpb25F6TaO/oipUVLabDSq57Fjb//MgvqkLWg=;
	b=aiWz6L9ZJRsogpfZYTV9XOWSjm/PIKPMgTCVMbhE6JRTH/Q5nlf8DyBhSovCb3C21/zFQa
	G8SzzH1KznGe4uGSonZHIzPSuYq+GzDhwVVk1uV5G0Gp3Pii/f4jejjTKqwijVaz58k7kq
	4KLchqDsZubYsPVW5gQtJAhKsHdru6c=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-321-m7iPIYuDO9uqkJ6sfV753Q-1; Thu, 18 Jun 2020 15:24:23 -0400
X-MC-Unique: m7iPIYuDO9uqkJ6sfV753Q-1
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 477E41005512;
	Thu, 18 Jun 2020 19:24:20 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id B82875D9C5;
	Thu, 18 Jun 2020 19:24:19 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 8FFB11809554;
	Thu, 18 Jun 2020 19:24:16 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com
	[10.11.54.3])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05II5Zhi011612 for <linux-audit@listman.util.phx.redhat.com>;
	Thu, 18 Jun 2020 14:05:36 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id D6E0C1067DB1; Thu, 18 Jun 2020 18:05:35 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id D23AE1067DAF
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 18:05:32 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com
	[207.211.31.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C3CC61049841
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 18:05:32 +0000 (UTC)
Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by
	relay.mimecast.com with ESMTP id us-mta-39-NUwpuhQ8PhKpM7DQ-fMNcg-1;
	Thu, 18 Jun 2020 14:05:28 -0400
X-MC-Unique: NUwpuhQ8PhKpM7DQ-fMNcg-1
Received: from [192.168.0.104] (c-73-42-176-67.hsd1.wa.comcast.net
	[73.42.176.67])
	by linux.microsoft.com (Postfix) with ESMTPSA id C614F20B4781;
	Thu, 18 Jun 2020 11:05:26 -0700 (PDT)
DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com C614F20B4781
Subject: Re: [PATCH 2/2] integrity: Add errno field in audit message
To: Mimi Zohar <zohar@linux.ibm.com>, bauerman@linux.ibm.com,
	nayna@linux.ibm.com, sgrubb@redhat.com, paul@paul-moore.com
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
	<20200617204436.2226-2-nramas@linux.microsoft.com>
	<1592502095.4615.42.camel@linux.ibm.com>
From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Message-ID: <8b3c99b9-6691-5ae2-a287-a22a2c801c59@linux.microsoft.com>
Date: Thu, 18 Jun 2020 11:05:22 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
	Thunderbird/68.8.0
MIME-Version: 1.0
In-Reply-To: <1592502095.4615.42.camel@linux.ibm.com>
Content-Language: en-US
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3
X-MIME-Autoconverted: from quoted-printable to 8bit by
	lists01.pubmisc.prod.ext.phx2.redhat.com id 05II5Zhi011612
X-loop: linux-audit@redhat.com
X-Mailman-Approved-At: Thu, 18 Jun 2020 15:24:15 -0400
Cc: rgb@redhat.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Content-Transfer-Encoding: base64

T24gNi8xOC8yMCAxMDo0MSBBTSwgTWltaSBab2hhciB3cm90ZToKCj4gCj4gRm9yIHRoZSByZWFz
b25zIHRoYXQgSSBtZW50aW9uZWQgcHJldmlvdXNseSwgdW5sZXNzIG90aGVycyBhcmUgd2lsbGlu
Zwo+IHRvIGFkZCB0aGVpciBSZXZpZXdlZC1ieSB0YWcgbm90IGZvciB0aGUgYXVkaXQgYXNwZWN0
IGluIHBhcnRpY3VsYXIsCj4gYnV0IElNQSBpdHNlbGYsIEknbSBub3QgY29tZm9ydGFibGUgbWFr
aW5nIHRoaXMgY2hhbmdlIGFsbCBhdCBvbmNlLgo+IAo+IFByZXZpb3VzbHkgSSBzdWdnZXN0ZWQg
bWFraW5nIHRoZSBleGlzdGluZyBpbnRlZ3JpdHlfYXVkaXRfbXNnKCkgYQo+IHdyYXBwZXIgZm9y
IGEgbmV3IGZ1bmN0aW9uIHdpdGggZXJybm8uIMKgU3RldmUgc2FpZCwgIldlIG5vcm1hbGx5IGRv
Cj4gbm90IGxpa2UgdG8gaGF2ZSBmaWVsZHMgdGhhdCBzd2luZyBpbiBhbmQgb3V0IC4uLiIsIGJ1
dCBzYWlkIHNldHRpbmcKPiBlcnJubyB0byAwIGlzIGZpbmUuIMKgVGhlIG9yaWdpbmFsIGludGVn
cml0eV9hdWRpdF9tc2coKSBmdW5jdGlvbiB3b3VsZAo+IGNhbGwgdGhlIG5ldyBmdW5jdGlvbiB3
aXRoIGVycm5vIHNldCB0byAwLgoKSWYgdGhlIG9yaWdpbmFsIGludGVncml0eV9hdWRpdF9tc2co
KSBhbHdheXMgY2FsbHMgdGhlIG5ldyBmdW5jdGlvbiB3aXRoIAplcnJubyBzZXQgdG8gMCwgdGhl
cmUgd291bGQgYmUgYXVkaXQgbWVzc2FnZXMgd2hlcmUgInJlcyIgZmllbGQgaXMgc2V0IAp0byAi
MCIgKGZhaWwpIGJlY2F1c2UgInJlc3VsdCIgd2FzIG5vbi16ZXJvLCBidXQgZXJybm8gc2V0IHRv
ICIwIiAKKHN1Y2Nlc3MpLiBXb3VsZG4ndCB0aGlzIGJlIGNvbmZ1c2luZz8KCkluIFBBVENIIDEv
MiBJJ3ZlIG1hZGUgY2hhbmdlcyB0byBtYWtlIHRoZSAicmVzdWx0IiBwYXJhbWV0ZXIgdG8gCmlu
dGVncml0eV9hdWRpdF9tc2coKSBjb25zaXN0ZW50IC0gaS5lLiwgaXQgaXMgYWx3YXlzIGFuIGVy
cm9yIGNvZGUgKDAgCmZvciBzdWNjZXNzIGFuZCBhIG5lZ2F0aXZlIHZhbHVlIGZvciBlcnJvciku
IFdvdWxkIHRoYXQgYWRkcmVzcyB5b3VyIApjb25jZXJucz8KCnRoYW5rcywKICAtbGFrc2htaQoK
CgoKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlzdApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0
dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9saW51eC1hdWRpdA==


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=mQOg=77=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no
	version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 10484C433DF
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:28 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id 4275220890
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:27 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="jO4o76u6"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4275220890
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.ibm.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592508266;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=PxEpo3sFrBGhsNngqXkgvZ034yecQPPdJcPnxWeNT5Y=;
	b=jO4o76u6PwJMZ5wUl9aATLeuXlt2rkOl4J1/AUd+Ao7P126+JEgfypyCgwuu7rv1xC62s3
	f3T5/du3Ppwdfu+fqn03KQz7fOKYDwIE3aJc1WnM+BE3yHFGtgLC4EIcwd8vO/09WF4y8z
	kCBBlrzWCS4en7p77SoOkamm5iYlr5s=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-304-_7YJ4StnNReva9lQikF1cg-1; Thu, 18 Jun 2020 15:24:24 -0400
X-MC-Unique: _7YJ4StnNReva9lQikF1cg-1
Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A916B1800D4A;
	Thu, 18 Jun 2020 19:24:20 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 79C3D5BAC2;
	Thu, 18 Jun 2020 19:24:20 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 8FF41180954D;
	Thu, 18 Jun 2020 19:24:16 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com
	[10.11.54.6])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05IHfsbl007598 for <linux-audit@listman.util.phx.redhat.com>;
	Thu, 18 Jun 2020 13:41:54 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id 4D7C82156A2D; Thu, 18 Jun 2020 17:41:54 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 481D72156A3A
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 17:41:47 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com
	[205.139.110.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id BA783101A526
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 17:41:47 +0000 (UTC)
Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com
	[148.163.156.1]) (Using TLS) by relay.mimecast.com with ESMTP id
	us-mta-20-yOjF7UBuPlKCgy4oZ85i8Q-1; Thu, 18 Jun 2020 13:41:45 -0400
X-MC-Unique: yOjF7UBuPlKCgy4oZ85i8Q-1
Received: from pps.filterd (m0098410.ppops.net [127.0.0.1])
	by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id
	05IH2ASi004724; Thu, 18 Jun 2020 13:41:44 -0400
Received: from pps.reinject (localhost [127.0.0.1])
	by mx0a-001b2d01.pphosted.com with ESMTP id 31r560g2n4-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 13:41:44 -0400
Received: from m0098410.ppops.net (m0098410.ppops.net [127.0.0.1])
	by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 05IHAnhU036160;
	Thu, 18 Jun 2020 13:41:43 -0400
Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com
	[169.51.49.98])
	by mx0a-001b2d01.pphosted.com with ESMTP id 31r560g2m3-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 13:41:43 -0400
Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1])
	by ppma03ams.nl.ibm.com (8.16.0.42/8.16.0.42) with SMTP id
	05IHdpFs029860; Thu, 18 Jun 2020 17:41:41 GMT
Received: from b06avi18878370.portsmouth.uk.ibm.com
	(b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194])
	by ppma03ams.nl.ibm.com with ESMTP id 31quax9fk6-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 17:41:40 +0000
Received: from b06wcsmtp001.portsmouth.uk.ibm.com
	(b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160])
	by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with
	ESMTP id 05IHfbrE59703556
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=OK); Thu, 18 Jun 2020 17:41:37 GMT
Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1])
	by IMSVA (Postfix) with ESMTP id 33C3CA405B;
	Thu, 18 Jun 2020 17:41:37 +0000 (GMT)
Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1])
	by IMSVA (Postfix) with ESMTP id 23E07A4054;
	Thu, 18 Jun 2020 17:41:36 +0000 (GMT)
Received: from localhost.localdomain (unknown [9.80.230.246])
	by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP;
	Thu, 18 Jun 2020 17:41:36 +0000 (GMT)
Message-ID: <1592502095.4615.42.camel@linux.ibm.com>
Subject: Re: [PATCH 2/2] integrity: Add errno field in audit message
From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
	bauerman@linux.ibm.com, nayna@linux.ibm.com, sgrubb@redhat.com,
	paul@paul-moore.com
Date: Thu, 18 Jun 2020 13:41:35 -0400
In-Reply-To: <20200617204436.2226-2-nramas@linux.microsoft.com>
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
	<20200617204436.2226-2-nramas@linux.microsoft.com>
Mime-Version: 1.0
X-TM-AS-GCONF: 00
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687
	definitions=2020-06-18_14:2020-06-18,
	2020-06-18 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0
	phishscore=0 clxscore=1015
	adultscore=0 malwarescore=0 mlxlogscore=999 spamscore=0
	lowpriorityscore=0
	bulkscore=0 priorityscore=1501 impostorscore=0 mlxscore=0
	suspectscore=0
	cotscore=-2147483648 classifier=spam adjust=0 reason=mlx scancount=1
	engine=8.12.0-2004280000 definitions=main-2006180125
X-MIME-Autoconverted: from 8bit to quoted-printable by
	mx0a-001b2d01.pphosted.com id 05IH2ASi004724
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6
X-MIME-Autoconverted: from quoted-printable to 8bit by
	lists01.pubmisc.prod.ext.phx2.redhat.com id 05IHfsbl007598
X-loop: linux-audit@redhat.com
X-Mailman-Approved-At: Thu, 18 Jun 2020 15:24:15 -0400
Cc: rgb@redhat.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

T24gV2VkLCAyMDIwLTA2LTE3IGF0IDEzOjQ0IC0wNzAwLCBMYWtzaG1pIFJhbWFzdWJyYW1hbmlh
biB3cm90ZToKPiBFcnJvciBjb2RlIGlzIG5vdCBpbmNsdWRlZCBpbiB0aGUgYXVkaXQgbWVzc2Fn
ZXMgbG9nZ2VkIGJ5Cj4gdGhlIGludGVncml0eSBzdWJzeXN0ZW0uIEFkZCAiZXJybm8iIGZpZWxk
IGluIHRoZSBhdWRpdCBtZXNzYWdlcwo+IGxvZ2dlZCBieSB0aGUgaW50ZWdyaXR5IHN1YnN5c3Rl
bSBhbmQgc2V0IHRoZSB2YWx1ZSB0byB0aGUgZXJyb3IgY29kZQo+IHBhc3NlZCB0byBpbnRlZ3Jp
dHlfYXVkaXRfbXNnKCkgaW4gdGhlICJyZXN1bHQiIHBhcmFtZXRlci4KPiAKPiBTYW1wbGUgYXVk
aXQgbWVzc2FnZXM6Cj4gCj4gWyAgICA2LjI4NDMyOV0gYXVkaXQ6IHR5cGU9MTgwNCBhdWRpdCgx
NTkxNzU2NzIzLjYyNzoyKTogcGlkPTEgdWlkPTAgYXVpZD00Mjk0OTY3Mjk1IHNlcz00Mjk0OTY3
Mjk1IHN1Ymo9a2VybmVsIG9wPWFkZF9ib290X2FnZ3JlZ2F0ZSBjYXVzZT1hbGxvY19lbnRyeSBj
b21tPSJzd2FwcGVyLzAiIG5hbWU9ImJvb3RfYWdncmVnYXRlIiByZXM9MCBlcnJubz0tMTIKPiAK
PiBbICAgIDguMDg1NDU2XSBhdWRpdDogdHlwZT0xODAyIGF1ZGl0KDE1OTIwMDU5NDcuMjk3Ojkp
OiBwaWQ9MSB1aWQ9MCBhdWlkPTQyOTQ5NjcyOTUgc2VzPTQyOTQ5NjcyOTUgc3Viaj1zeXN0ZW1f
dTpzeXN0ZW1fcjppbml0X3Q6czAgb3A9cG9saWN5X3VwZGF0ZSBjYXVzZT1jb21wbGV0ZWQgY29t
bT0ic3lzdGVtZCIgcmVzPTEgZXJybm89MAo+IAo+IFNpZ25lZC1vZmYtYnk6IExha3NobWkgUmFt
YXN1YnJhbWFuaWFuIDxucmFtYXNAbGludXgubWljcm9zb2Z0LmNvbT4KPiBTdWdnZXN0ZWQtYnk6
IFN0ZXZlIEdydWJiIDxzZ3J1YmJAcmVkaGF0LmNvbT4KPiAtLS0KPiAgc2VjdXJpdHkvaW50ZWdy
aXR5L2ludGVncml0eV9hdWRpdC5jIHwgMiArLQo+ICAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRp
b24oKyksIDEgZGVsZXRpb24oLSkKPiAKPiBkaWZmIC0tZ2l0IGEvc2VjdXJpdHkvaW50ZWdyaXR5
L2ludGVncml0eV9hdWRpdC5jIGIvc2VjdXJpdHkvaW50ZWdyaXR5L2ludGVncml0eV9hdWRpdC5j
Cj4gaW5kZXggNTEwOTE3MzgzOWNjLi5hMjY1MDI0ZjgyZjMgMTAwNjQ0Cj4gLS0tIGEvc2VjdXJp
dHkvaW50ZWdyaXR5L2ludGVncml0eV9hdWRpdC5jCj4gKysrIGIvc2VjdXJpdHkvaW50ZWdyaXR5
L2ludGVncml0eV9hdWRpdC5jCj4gQEAgLTUzLDYgKzUzLDYgQEAgdm9pZCBpbnRlZ3JpdHlfYXVk
aXRfbXNnKGludCBhdWRpdF9tc2dubywgc3RydWN0IGlub2RlICppbm9kZSwKPiAgCQlhdWRpdF9s
b2dfdW50cnVzdGVkc3RyaW5nKGFiLCBpbm9kZS0+aV9zYi0+c19pZCk7Cj4gIAkJYXVkaXRfbG9n
X2Zvcm1hdChhYiwgIiBpbm89JWx1IiwgaW5vZGUtPmlfaW5vKTsKPiAgCX0KPiAtCWF1ZGl0X2xv
Z19mb3JtYXQoYWIsICIgcmVzPSVkIiwgIXJlc3VsdCk7Cj4gKwlhdWRpdF9sb2dfZm9ybWF0KGFi
LCAiIHJlcz0lZCBlcnJubz0lZCIsICFyZXN1bHQsIHJlc3VsdCk7Cj4gIAlhdWRpdF9sb2dfZW5k
KGFiKTsKPiAgfQoKRm9yIHRoZSByZWFzb25zIHRoYXQgSSBtZW50aW9uZWQgcHJldmlvdXNseSwg
dW5sZXNzIG90aGVycyBhcmUgd2lsbGluZwp0byBhZGQgdGhlaXIgUmV2aWV3ZWQtYnkgdGFnIG5v
dCBmb3IgdGhlIGF1ZGl0IGFzcGVjdCBpbiBwYXJ0aWN1bGFyLApidXQgSU1BIGl0c2VsZiwgSSdt
IG5vdCBjb21mb3J0YWJsZSBtYWtpbmcgdGhpcyBjaGFuZ2UgYWxsIGF0IG9uY2UuCgpQcmV2aW91
c2x5IEkgc3VnZ2VzdGVkIG1ha2luZyB0aGUgZXhpc3RpbmcgaW50ZWdyaXR5X2F1ZGl0X21zZygp
IGEKd3JhcHBlciBmb3IgYSBuZXcgZnVuY3Rpb24gd2l0aCBlcnJuby4gwqBTdGV2ZSBzYWlkLCAi
V2Ugbm9ybWFsbHkgZG8Kbm90IGxpa2UgdG8gaGF2ZSBmaWVsZHMgdGhhdCBzd2luZyBpbiBhbmQg
b3V0IC4uLiIsIGJ1dCBzYWlkIHNldHRpbmcKZXJybm8gdG8gMCBpcyBmaW5lLiDCoFRoZSBvcmln
aW5hbCBpbnRlZ3JpdHlfYXVkaXRfbXNnKCkgZnVuY3Rpb24gd291bGQKY2FsbCB0aGUgbmV3IGZ1
bmN0aW9uIHdpdGggZXJybm8gc2V0IHRvIDAuCgpNaW1pCgoKLS0KTGludXgtYXVkaXQgbWFpbGlu
ZyBsaXN0CkxpbnV4LWF1ZGl0QHJlZGhhdC5jb20KaHR0cHM6Ly93d3cucmVkaGF0LmNvbS9tYWls
bWFuL2xpc3RpbmZvL2xpbnV4LWF1ZGl0


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=mQOg=77=redhat.com=linux-audit-bounces@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS autolearn=no autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 1DA1FC433DF
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:37 +0000 (UTC)
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.kernel.org (Postfix) with ESMTPS id C5FD0206F7
	for <linux-audit@archiver.kernel.org>; Thu, 18 Jun 2020 19:24:36 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="YubWcGmB"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C5FD0206F7
Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.ibm.com
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-audit-bounces@redhat.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
	s=mimecast20190719; t=1592508275;
	h=from:from:sender:sender:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:cc:mime-version:mime-version:
	 content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references:list-id:list-help:
	 list-unsubscribe:list-subscribe:list-post;
	bh=xDpBFOFMXdjh+8CIrCkO5pHLgljKZuCZEg/gOMKPWTg=;
	b=YubWcGmBFGfEsHwiJFGolkHhXdW1DHOeHJmFEmqsTlKpQBMLHAOne+eCWlwwwxmddKoOV6
	4nJ1voaNQ7CnMDOhwkeO45bt4QTTRx6RR1mcR9KYZSr2Yzw6N4za2jY0P/10lzrFfVZXiZ
	BkIMgIlv/XUlrKS1xM8LC4YXwfYvRCQ=
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-78-gJVW61VsOXSr1iJk4DkcrQ-1; Thu, 18 Jun 2020 15:24:33 -0400
X-MC-Unique: gJVW61VsOXSr1iJk4DkcrQ-1
Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 46B248018A7;
	Thu, 18 Jun 2020 19:24:30 +0000 (UTC)
Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 2FBBB1002393;
	Thu, 18 Jun 2020 19:24:30 +0000 (UTC)
Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33])
	by colo-mx.corp.redhat.com (Postfix) with ESMTP id 135C0833C6;
	Thu, 18 Jun 2020 19:24:30 +0000 (UTC)
Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com
	[10.11.54.4])
	by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id 05IIAIud012055 for <linux-audit@listman.util.phx.redhat.com>;
	Thu, 18 Jun 2020 14:10:18 -0400
Received: by smtp.corp.redhat.com (Postfix)
	id 606212029F62; Thu, 18 Jun 2020 18:10:18 +0000 (UTC)
Received: from mimecast-mx02.redhat.com
	(mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 5AD0E2026E1C
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 18:10:16 +0000 (UTC)
Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com
	[207.211.31.120])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
	(No client certificate requested)
	by mimecast-mx02.redhat.com (Postfix) with ESMTPS id EAAED82A6F6
	for <linux-audit@redhat.com>; Thu, 18 Jun 2020 18:10:15 +0000 (UTC)
Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com
	[148.163.158.5]) (Using TLS) by relay.mimecast.com with ESMTP id
	us-mta-153-HXYknQE4OP-qn5RWnSD9qA-1; Thu, 18 Jun 2020 14:10:13 -0400
X-MC-Unique: HXYknQE4OP-qn5RWnSD9qA-1
Received: from pps.filterd (m0098421.ppops.net [127.0.0.1])
	by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id
	05II1c1Q055669; Thu, 18 Jun 2020 14:10:12 -0400
Received: from pps.reinject (localhost [127.0.0.1])
	by mx0a-001b2d01.pphosted.com with ESMTP id 31ra0vy1dd-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 14:10:12 -0400
Received: from m0098421.ppops.net (m0098421.ppops.net [127.0.0.1])
	by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 05II2fnZ058528;
	Thu, 18 Jun 2020 14:10:11 -0400
Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com
	[169.51.49.99])
	by mx0a-001b2d01.pphosted.com with ESMTP id 31ra0vy1c1-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 14:10:11 -0400
Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1])
	by ppma04ams.nl.ibm.com (8.16.0.42/8.16.0.42) with SMTP id
	05IIA7wM007860; Thu, 18 Jun 2020 18:10:10 GMT
Received: from b06avi18878370.portsmouth.uk.ibm.com
	(b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194])
	by ppma04ams.nl.ibm.com with ESMTP id 31qur61fm0-1
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NOT); Thu, 18 Jun 2020 18:10:09 +0000
Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com
	[9.149.105.62])
	by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with
	ESMTP id 05IIA6PO61210882
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=OK); Thu, 18 Jun 2020 18:10:06 GMT
Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1])
	by IMSVA (Postfix) with ESMTP id 7B6AAAE06A;
	Thu, 18 Jun 2020 18:10:06 +0000 (GMT)
Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1])
	by IMSVA (Postfix) with ESMTP id 6E2B4AE05F;
	Thu, 18 Jun 2020 18:10:05 +0000 (GMT)
Received: from localhost.localdomain (unknown [9.80.230.246])
	by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP;
	Thu, 18 Jun 2020 18:10:05 +0000 (GMT)
Message-ID: <1592503804.4615.47.camel@linux.ibm.com>
Subject: Re: [PATCH 2/2] integrity: Add errno field in audit message
From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
	bauerman@linux.ibm.com, nayna@linux.ibm.com, sgrubb@redhat.com,
	paul@paul-moore.com
Date: Thu, 18 Jun 2020 14:10:04 -0400
In-Reply-To: <8b3c99b9-6691-5ae2-a287-a22a2c801c59@linux.microsoft.com>
References: <20200617204436.2226-1-nramas@linux.microsoft.com>
	<20200617204436.2226-2-nramas@linux.microsoft.com>
	<1592502095.4615.42.camel@linux.ibm.com>
	<8b3c99b9-6691-5ae2-a287-a22a2c801c59@linux.microsoft.com>
Mime-Version: 1.0
X-TM-AS-GCONF: 00
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687
	definitions=2020-06-18_14:2020-06-18,
	2020-06-18 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0
	mlxlogscore=999 clxscore=1015
	impostorscore=0 bulkscore=0 cotscore=-2147483648 lowpriorityscore=0
	mlxscore=0 spamscore=0 malwarescore=0 suspectscore=0 adultscore=0
	phishscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx
	scancount=1 engine=8.12.0-2004280000 definitions=main-2006180134
X-MIME-Autoconverted: from 8bit to quoted-printable by
	mx0a-001b2d01.pphosted.com id 05II1c1Q055669
X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4
X-MIME-Autoconverted: from quoted-printable to 8bit by
	lists01.pubmisc.prod.ext.phx2.redhat.com id 05IIAIud012055
X-loop: linux-audit@redhat.com
X-Mailman-Approved-At: Thu, 18 Jun 2020 15:24:15 -0400
Cc: rgb@redhat.com, linux-integrity@vger.kernel.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
X-BeenThere: linux-audit@redhat.com
X-Mailman-Version: 2.1.12
Precedence: junk
List-Id: Linux Audit Discussion <linux-audit.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

T24gVGh1LCAyMDIwLTA2LTE4IGF0IDExOjA1IC0wNzAwLCBMYWtzaG1pIFJhbWFzdWJyYW1hbmlh
biB3cm90ZToKPiBPbiA2LzE4LzIwIDEwOjQxIEFNLCBNaW1pIFpvaGFyIHdyb3RlOgo+IAo+ID4g
Cj4gPiBGb3IgdGhlIHJlYXNvbnMgdGhhdCBJIG1lbnRpb25lZCBwcmV2aW91c2x5LCB1bmxlc3Mg
b3RoZXJzIGFyZSB3aWxsaW5nCj4gPiB0byBhZGQgdGhlaXIgUmV2aWV3ZWQtYnkgdGFnIG5vdCBm
b3IgdGhlIGF1ZGl0IGFzcGVjdCBpbiBwYXJ0aWN1bGFyLAo+ID4gYnV0IElNQSBpdHNlbGYsIEkn
bSBub3QgY29tZm9ydGFibGUgbWFraW5nIHRoaXMgY2hhbmdlIGFsbCBhdCBvbmNlLgo+ID4gCj4g
PiBQcmV2aW91c2x5IEkgc3VnZ2VzdGVkIG1ha2luZyB0aGUgZXhpc3RpbmcgaW50ZWdyaXR5X2F1
ZGl0X21zZygpIGEKPiA+IHdyYXBwZXIgZm9yIGEgbmV3IGZ1bmN0aW9uIHdpdGggZXJybm8uIMKg
U3RldmUgc2FpZCwgIldlIG5vcm1hbGx5IGRvCj4gPiBub3QgbGlrZSB0byBoYXZlIGZpZWxkcyB0
aGF0IHN3aW5nIGluIGFuZCBvdXQgLi4uIiwgYnV0IHNhaWQgc2V0dGluZwo+ID4gZXJybm8gdG8g
MCBpcyBmaW5lLiDCoFRoZSBvcmlnaW5hbCBpbnRlZ3JpdHlfYXVkaXRfbXNnKCkgZnVuY3Rpb24g
d291bGQKPiA+IGNhbGwgdGhlIG5ldyBmdW5jdGlvbiB3aXRoIGVycm5vIHNldCB0byAwLgo+IAo+
IElmIHRoZSBvcmlnaW5hbCBpbnRlZ3JpdHlfYXVkaXRfbXNnKCkgYWx3YXlzIGNhbGxzIHRoZSBu
ZXcgZnVuY3Rpb24gd2l0aCAKPiBlcnJubyBzZXQgdG8gMCwgdGhlcmUgd291bGQgYmUgYXVkaXQg
bWVzc2FnZXMgd2hlcmUgInJlcyIgZmllbGQgaXMgc2V0IAo+IHRvICIwIiAoZmFpbCkgYmVjYXVz
ZSAicmVzdWx0IiB3YXMgbm9uLXplcm8sIGJ1dCBlcnJubyBzZXQgdG8gIjAiIAo+IChzdWNjZXNz
KS4gV291bGRuJ3QgdGhpcyBiZSBjb25mdXNpbmc/Cj4gCj4gSW4gUEFUQ0ggMS8yIEkndmUgbWFk
ZSBjaGFuZ2VzIHRvIG1ha2UgdGhlICJyZXN1bHQiIHBhcmFtZXRlciB0byAKPiBpbnRlZ3JpdHlf
YXVkaXRfbXNnKCkgY29uc2lzdGVudCAtIGkuZS4sIGl0IGlzIGFsd2F5cyBhbiBlcnJvciBjb2Rl
ICgwIAo+IGZvciBzdWNjZXNzIGFuZCBhIG5lZ2F0aXZlIHZhbHVlIGZvciBlcnJvcikuIFdvdWxk
IHRoYXQgYWRkcmVzcyB5b3VyIAo+IGNvbmNlcm5zPwoKWW91J3JlIG92ZXJsb2FkaW5nICJyZXMi
IHRvIGltcGx5IGVycm5vLiDCoERlZmluZSBhIG5ldyBwYXJhbWV0ZXIKc3BlY2lmaWNhbGx5IGZv
ciBlcnJuby4KCk1pbWkKCgotLQpMaW51eC1hdWRpdCBtYWlsaW5nIGxpc3QKTGludXgtYXVkaXRA
cmVkaGF0LmNvbQpodHRwczovL3d3dy5yZWRoYXQuY29tL21haWxtYW4vbGlzdGluZm8vbGludXgt
YXVkaXQ=


