Re: [PATCH v3 1/2] integrity: Report error code in integrity_audit_msg() call sites

to take an error code and report
errors the same as integrity_audit_message().

Signed-off-by: Frederick Lawler <redacted>
---
 security/integrity/evm/evm_main.c         |  9 +++++----
 security/integrity/ima/ima_api.c          |  8 ++++----
 security/integrity/ima/ima_appraise.c     |  6 +++---
 security/integrity/ima/ima_fs.c           |  4 ++--
 security/integrity/ima/ima_init.c         |  2 +-
 security/integrity/ima/ima_main.c         |  7 ++++---
 security/integrity/ima/ima_policy.c       | 11 ++++++-----
 security/integrity/ima/ima_queue.c        |  2 +-
 security/integrity/ima/ima_template_lib.c |  2 +-
 security/integrity/integrity.h            |  5 +++--
 security/integrity/integrity_audit.c      |  5 +++--
 11 files changed, 33 insertions(+), 28 deletions(-)

diff --git a/security/integrity/evm/evm_main.c

b/security/integrity/evm/evm_main.c
index
b59e3f121b8a89edb14d811351ec393a69de8ff7..5be9349afcd09b47b78d1126ffc1fe341264
ae6e 100644

--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c

@@ -563,7 +563,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap,

      dentry->d_inode, dentry->d_name.name,
      "update_metadata",
      integrity_status_msg[evm_status],
-     -EPERM, 0);
+     -EPERM, 0, -EPERM);
  }
 out:
  /* Exception if the HMAC is not going to be calculated. */

@@ -588,7 +588,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap,

  integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
      dentry->d_name.name, "appraise_metadata",
      integrity_status_msg[evm_status],
-     -EPERM, 0);
+     -EPERM, 0, -EPERM);
  return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
 }
 

@@ -729,7 +729,7 @@ static int evm_inode_set_acl(struct mnt_idmap *idmap,

struct dentry *dentry,
  integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
      dentry->d_name.name, "appraise_metadata",
      integrity_status_msg[evm_status],
-     -EPERM, 0);
+     -EPERM, 0, -EPERM);
  return -EPERM;
 }
 

@@ -992,7 +992,8 @@ static int evm_inode_setattr(struct mnt_idmap *idmap,

struct dentry *dentry,
 
  integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
      dentry->d_name.name, "appraise_metadata",
-     integrity_status_msg[evm_status], -EPERM, 0);
+     integrity_status_msg[evm_status], -EPERM, 0,
+     -EPERM);
  return -EPERM;
 }
 

diff --git a/security/integrity/ima/ima_api.c

b/security/integrity/ima/ima_api.c
index
122d127e108dcca8ddae6575c908144859783fb6..f765bfe5db68d0847cfe5b47f81b64018083
f65a 100644

--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c

@@ -116,7 +116,7 @@ int ima_store_template(struct ima_template_entry *entry,

  if (result < 0) {
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
      template_name, op,
-     audit_cause, result, 0);
+     audit_cause, result, 0, result);
  return result;
  }
  }

@@ -159,7 +159,7 @@ void ima_add_violation(struct file *file, const unsigned

char *filename,
  ima_free_template_entry(entry);
 err_out:
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
-     op, cause, result, 0);
+     op, cause, result, 0, result);
 }
 
 /**

@@ -330,7 +330,7 @@ int ima_collect_measurement(struct ima_iint_cache *iint,

struct file *file,
 
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
      filename.name.name, "collect_data",
-     audit_cause, result, 0);
+     audit_cause, result, 0, result);
 
  release_dentry_name_snapshot(&filename);
  }

@@ -383,7 +383,7 @@ void ima_store_measurement(struct ima_iint_cache *iint,

struct file *file,
  result = ima_alloc_init_template(&event_data, &entry, template_desc);
  if (result < 0) {
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
-     op, audit_cause, result, 0);
+     op, audit_cause, result, 0, result);
  return;
  }
 

diff --git a/security/integrity/ima/ima_appraise.c

b/security/integrity/ima/ima_appraise.c
index
b280488e15fcb0b6f8a8a0caaab93c7d511e4a40..6dc712f430f44ee18c3418a6bf4cd4da4975
8b98 100644

--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c

@@ -564,7 +564,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct

ima_iint_cache *iint,
  status = INTEGRITY_FAIL;
  cause = "unverifiable-signature";
  integrity_audit_msg(audit_msgno, inode, filename,
-     op, cause, rc, 0);
+     op, cause, rc, 0, rc);
  } else if (status != INTEGRITY_PASS) {
  /* Fix mode, but don't replace file signatures. */
  if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&

@@ -589,7 +589,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct

ima_iint_cache *iint,
  }
 
  integrity_audit_msg(audit_msgno, inode, filename,
-     op, cause, rc, 0);
+     op, cause, rc, 0, rc);
  } else {
  ima_cache_flags(iint, func);
  }

@@ -752,7 +752,7 @@ static int validate_hash_algo(struct dentry *dentry,

  path = NULL;
 
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path,
-     "set_data", errmsg, -EACCES, 0);
+     "set_data", errmsg, -EACCES, 0, -EACCES);
 
  kfree(pathbuf);
 

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c

index
2a0bca5543161912abe2a0236c9fcae7055e62bc..6d2ef44b21f8d40b4981a6a441cf7c3d69f9
4dee 100644

--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c

@@ -595,7 +595,7 @@ static ssize_t ima_write_policy(struct file *file, const

char __user *buf,
  pr_err("signed policy file (specified as an absolute pathname) required\n");
  integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
      "policy_update", "signed policy required",
-     1, 0);
+     1, 0, -EINVAL);

  result = -EACCES;
  } else {
  ima_measure_raw_policy(data, datalen);

@@ -745,7 +745,7 @@ static int ima_release_policy(struct inode *inode, struct

file *file)
 
  pr_info("policy update %s\n", cause);
  integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
-     "policy_update", cause, !valid_policy, 0);
+     "policy_update", cause, !valid_policy, 0, 0);

  if (!valid_policy) {
  ima_delete_rules();

diff --git a/security/integrity/ima/ima_init.c

b/security/integrity/ima/ima_init.c
index
d53f4d89a53e56d7ebb31950c10b37fc89782753..7a76e2686267482b10bf854a76829c60ef9f
1e1b 100644

--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c

@@ -103,7 +103,7 @@ static int __init ima_add_boot_aggregate(void)

  return 0;
 err_out:
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op,
-     audit_cause, result, 0);
+     audit_cause, result, 0, result);
  return result;
 }
 

diff --git a/security/integrity/ima/ima_main.c

b/security/integrity/ima/ima_main.c
index
ab1e53b3210d3a4d3f91d65f7db19e6a2a2d401c..9e80f40680d7be08d14d26ba48ed334d4e4a
b10c 100644

--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c

@@ -119,7 +119,7 @@ static int mmap_violation_check(enum ima_hooks func,

struct file *file,
  *pathname = ima_d_path(&file->f_path, pathbuf,
         filename);
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname,
-     "mmap_file", "mmapped_writers", rc, 0);
+     "mmap_file", "mmapped_writers", rc, 0, rc);
  }
  return rc;
 }

@@ -466,7 +466,7 @@ static int process_measurement(struct file *file, const

struct cred *cred,
 
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, file_inode(file),
      pathname, "collect_data",
-     "denied-hash-algorithm", rc, 0);
+     "denied-hash-algorithm", rc, 0, rc);
  }
 out_locked:
  if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&

@@ -579,7 +579,8 @@ static int ima_file_mprotect(struct vm_area_struct *vma,

unsigned long reqprot,
  file = vma->vm_file;
  pathname = ima_d_path(&file->f_path, &pathbuf, filename);
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname,
-     "collect_data", "failed-mprotect", result, 0);
+     "collect_data", "failed-mprotect", result, 0,
+     result);
  if (pathbuf)
  __putname(pathbuf);
 

diff --git a/security/integrity/ima/ima_policy.c

b/security/integrity/ima/ima_policy.c
index
68d9a5e6c232ea0678e9f51f105cebecccccb43e..9013c962dc0bfd6184948230ad6746e71f6e
82f5 100644

--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c

@@ -1992,7 +1992,8 @@ ssize_t ima_parse_add_rule(char *rule)

  entry = kzalloc_obj(*entry);
  if (!entry) {
  integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
-     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
+     NULL, op, "-ENOMEM", -ENOMEM, audit_info,
+     -ENOMEM);
  return -ENOMEM;
  }
 

@@ -2003,7 +2004,7 @@ ssize_t ima_parse_add_rule(char *rule)

  ima_free_rule(entry);
  integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
      NULL, op, "invalid-policy", result,
-     audit_info);
+     audit_info, result);
  return result;
  }
 

@@ -2421,7 +2422,7 @@ void ima_measure_loaded_policy(void)

  rule = kmalloc(rule_len, GFP_KERNEL);
  if (!rule) {
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
-     op, "ENOMEM", result, 0);
+     op, "ENOMEM", result, 0, result);
  return;
  }
 

@@ -2440,7 +2441,7 @@ void ima_measure_loaded_policy(void)

  result = -E2BIG;
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL,
      event_name, op, "rule_length",
-     result, 0);
+     result, 0, result);
  rcu_read_unlock();
  goto free_rule;
  }

@@ -2454,7 +2455,7 @@ void ima_measure_loaded_policy(void)

  file.buf = kmalloc(file_len, GFP_KERNEL);
  if (!file.buf) {
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
-     op, "ENOMEM", result, 0);
+     op, "ENOMEM", result, 0, result);
  goto free_rule;
  }
 

diff --git a/security/integrity/ima/ima_queue.c

b/security/integrity/ima/ima_queue.c
index
f89f0ca3d4edf16a7147b3c23d25fc2cf18044c6..8d3282ff7da4131ae4389bf832442285e500
542d 100644

--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c

@@ -292,7 +292,7 @@ int ima_add_template_entry(struct ima_template_entry

*entry, int violation,
 out:
  mutex_unlock(&ima_extend_list_mutex);
  integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
-     op, audit_cause, result, audit_info);
+     op, audit_cause, result, audit_info, result);
  return result;
 }
 

diff --git a/security/integrity/ima/ima_template_lib.c

b/security/integrity/ima/ima_template_lib.c
index
8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..9bd80ca1159a2fe24b3ea3308a118f6beea7
33cb 100644

--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c

@@ -392,7 +392,7 @@ int ima_eventdigest_init(struct ima_event_data

*event_data,
  if (result) {
  integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
      event_data->filename, "collect_data",
-     "failed", result, 0);
+     "failed", result, 0, result);
  return result;
  }
  cur_digest = hash_hdr->digest;

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h

index
0c581c03c5da72d80e9c352a7adff1fb89628644..2ab6b7e34e7ee2dd29ae03ae1fb45fa26d9c
032a 100644

--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h

@@ -218,7 +218,8 @@ static inline void evm_load_x509(void)

 /* declarations */
 void integrity_audit_msg(int audit_msgno, struct inode *inode,
  const unsigned char *fname, const char *op,
- const char *cause, int result, int info);
+ const char *cause, int result, int info,
+ int errno);
 
 void integrity_audit_message(int audit_msgno, struct inode *inode,
       const unsigned char *fname, const char *op,

@@ -235,7 +236,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t

gfp_mask, int type)
 static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
         const unsigned char *fname,
         const char *op, const char *cause,
-        int result, int info)
+        int result, int info, int errno)
 {
 }
 

diff --git a/security/integrity/integrity_audit.c

b/security/integrity/integrity_audit.c
index
d8d9e5ff1cd22b091f462d1e83d28d2d6bd983e9..2dd2d7e3916e7bf35c753450315ff22e2d02
92b7 100644

--- a/security/integrity/integrity_audit.c
+++ b/security/integrity/integrity_audit.c

@@ -27,10 +27,11 @@ __setup("integrity_audit=", integrity_audit_setup);

 
 void integrity_audit_msg(int audit_msgno, struct inode *inode,
  const unsigned char *fname, const char *op,
- const char *cause, int result, int audit_info)
+ const char *cause, int result, int audit_info,
+ int errno)
 {
  integrity_audit_message(audit_msgno, inode, fname, op, cause,
- result, audit_info, 0);
+ result, audit_info, errno);
 }
 
 void integrity_audit_message(int audit_msgno, struct inode *inode,