github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

integrity: Report error code in integrity_audit_msg() call sites

Browse Source 
integrity_audit_msg() hides error codes by wrapping
integrity_audit_message() which obfuscates the underlying reason for the
failure.

Update integrity_audit_msg() to take a errno argument, and pass that
through to integrity_audit_message(). Then update call sites to
take caller's respective error codes.

ima_appraise_measurement() stores xattr_len as the return code, but
can replace it with a error code later. Therefore conditionally use
a code if rc < 0, otherwise report zero. Lastly, conditionally use
-EINVAL for ima_release_policy().

Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Reviewed-by: Enrico Bravi <enrico.bravi@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Frederick Lawler 2026-09-24 15:34:58 -05:00 committed by Mimi Zohar
parent df2908090c
commit ca1e0f3cce
11 changed files with 35 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/integrity/evm/evm_main.c
View File

@ -563,7 +563,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap,
dentry->d_inode, dentry->d_name.name,
"update_metadata",
integrity_status_msg[evm_status],
-EPERM, 0);
-EPERM, 0, -EPERM);
}
out:
/* Exception if the HMAC is not going to be calculated. */
@ -588,7 +588,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap,
integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
dentry->d_name.name, "appraise_metadata",
integrity_status_msg[evm_status],
-EPERM, 0);
-EPERM, 0, -EPERM);
return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
}
@ -729,7 +729,7 @@ static int evm_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
dentry->d_name.name, "appraise_metadata",
integrity_status_msg[evm_status],
-EPERM, 0);
-EPERM, 0, -EPERM);
return -EPERM;
}
@ -992,7 +992,8 @@ static int evm_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
dentry->d_name.name, "appraise_metadata",
integrity_status_msg[evm_status], -EPERM, 0);
integrity_status_msg[evm_status], -EPERM, 0,
-EPERM);
return -EPERM;
}

8
security/integrity/ima/ima_api.c
View File

@ -116,7 +116,7 @@ int ima_store_template(struct ima_template_entry *entry,
if (result < 0) {
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
template_name, op,
audit_cause, result, 0);
audit_cause, result, 0, result);
return result;
}
}
@ -159,7 +159,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
ima_free_template_entry(entry);
err_out:
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
op, cause, result, 0);
op, cause, result, 0, result);
}
/**
@ -330,7 +330,7 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
filename.name.name, "collect_data",
audit_cause, result, 0);
audit_cause, result, 0, result);
release_dentry_name_snapshot(&filename);
}
@ -383,7 +383,7 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
result = ima_alloc_init_template(&event_data, &entry, template_desc);
if (result < 0) {
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
op, audit_cause, result, 0);
op, audit_cause, result, 0, result);
return;
}

6
security/integrity/ima/ima_appraise.c
View File

@ -564,7 +564,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
status = INTEGRITY_FAIL;
cause = "unverifiable-signature";
integrity_audit_msg(audit_msgno, inode, filename,
op, cause, rc, 0);
op, cause, rc, 0, rc < 0 ? rc : 0);
} else if (status != INTEGRITY_PASS) {
/* Fix mode, but don't replace file signatures. */
if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
@ -589,7 +589,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
}
integrity_audit_msg(audit_msgno, inode, filename,
op, cause, rc, 0);
op, cause, rc, 0, rc < 0 ? rc : 0);
} else {
ima_cache_flags(iint, func);
}
@ -752,7 +752,7 @@ static int validate_hash_algo(struct dentry *dentry,
path = NULL;
integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path,
"set_data", errmsg, -EACCES, 0);
"set_data", errmsg, -EACCES, 0, -EACCES);
kfree(pathbuf);

7
security/integrity/ima/ima_fs.c
View File

@ -592,11 +592,11 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
if (data[0] == '/') {
result = ima_read_policy(data);
} else if (ima_appraise & IMA_APPRAISE_POLICY) {
result = -EACCES;
pr_err("signed policy file (specified as an absolute pathname) required\n");
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
"policy_update", "signed policy required",
1, 0);
result = -EACCES;
result, 0, result);
} else {
ima_measure_raw_policy(data, datalen);
result = ima_parse_add_rule(data);
@ -745,7 +745,8 @@ static int ima_release_policy(struct inode *inode, struct file *file)
pr_info("policy update %s\n", cause);
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
"policy_update", cause, !valid_policy, 0);
"policy_update", cause, !valid_policy, 0,
!valid_policy ? -EINVAL : 0);
if (!valid_policy) {
ima_delete_rules();

2
security/integrity/ima/ima_init.c
View File

@ -103,7 +103,7 @@ static int __init ima_add_boot_aggregate(void)
return 0;
err_out:
integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op,
audit_cause, result, 0);
audit_cause, result, 0, result);
return result;
}

7
security/integrity/ima/ima_main.c
View File

@ -119,7 +119,7 @@ static int mmap_violation_check(enum ima_hooks func, struct file *file,
*pathname = ima_d_path(&file->f_path, pathbuf,
filename);
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname,
"mmap_file", "mmapped_writers", rc, 0);
"mmap_file", "mmapped_writers", rc, 0, rc);
}
return rc;
}
@ -466,7 +466,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
integrity_audit_msg(AUDIT_INTEGRITY_DATA, file_inode(file),
pathname, "collect_data",
"denied-hash-algorithm", rc, 0);
"denied-hash-algorithm", rc, 0, rc);
}
out_locked:
if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&
@ -579,7 +579,8 @@ static int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
file = vma->vm_file;
pathname = ima_d_path(&file->f_path, &pathbuf, filename);
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname,
"collect_data", "failed-mprotect", result, 0);
"collect_data", "failed-mprotect", result, 0,
result);
if (pathbuf)
__putname(pathbuf);

11
security/integrity/ima/ima_policy.c
View File

@ -1992,7 +1992,8 @@ ssize_t ima_parse_add_rule(char *rule)
entry = kzalloc_obj(*entry);
if (!entry) {
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
NULL, op, "-ENOMEM", -ENOMEM, audit_info);
NULL, op, "-ENOMEM", -ENOMEM, audit_info,
-ENOMEM);
return -ENOMEM;
}
@ -2003,7 +2004,7 @@ ssize_t ima_parse_add_rule(char *rule)
ima_free_rule(entry);
integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
NULL, op, "invalid-policy", result,
audit_info);
audit_info, result);
return result;
}
@ -2421,7 +2422,7 @@ void ima_measure_loaded_policy(void)
rule = kmalloc(rule_len, GFP_KERNEL);
if (!rule) {
integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
op, "ENOMEM", result, 0);
op, "ENOMEM", result, 0, result);
return;
}
@ -2440,7 +2441,7 @@ void ima_measure_loaded_policy(void)
result = -E2BIG;
integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL,
event_name, op, "rule_length",
result, 0);
result, 0, result);
rcu_read_unlock();
goto free_rule;
}
@ -2454,7 +2455,7 @@ void ima_measure_loaded_policy(void)
file.buf = kmalloc(file_len, GFP_KERNEL);
if (!file.buf) {
integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name,
op, "ENOMEM", result, 0);
op, "ENOMEM", result, 0, result);
goto free_rule;
}

2
security/integrity/ima/ima_queue.c
View File

@ -291,7 +291,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
out:
mutex_unlock(&ima_extend_list_mutex);
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
op, audit_cause, result, audit_info);
op, audit_cause, result, audit_info, result);
return result;
}

2
security/integrity/ima/ima_template_lib.c
View File

@ -392,7 +392,7 @@ int ima_eventdigest_init(struct ima_event_data *event_data,
if (result) {
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
event_data->filename, "collect_data",
"failed", result, 0);
"failed", result, 0, result);
return result;
}
cur_digest = hash_hdr->digest;

5
security/integrity/integrity.h
View File

@ -218,7 +218,8 @@ static inline void evm_load_x509(void)
/* declarations */
void integrity_audit_msg(int audit_msgno, struct inode *inode,
const unsigned char *fname, const char *op,
const char *cause, int result, int info);
const char *cause, int result, int info,
int errno);
void integrity_audit_message(int audit_msgno, struct inode *inode,
const unsigned char *fname, const char *op,
@ -235,7 +236,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
const unsigned char *fname,
const char *op, const char *cause,
int result, int info)
int result, int info, int errno)
{
}

5
security/integrity/integrity_audit.c
View File

@ -27,10 +27,11 @@ __setup("integrity_audit=", integrity_audit_setup);
void integrity_audit_msg(int audit_msgno, struct inode *inode,
const unsigned char *fname, const char *op,
const char *cause, int result, int audit_info)
const char *cause, int result, int audit_info,
int errno)
{
integrity_audit_message(audit_msgno, inode, fname, op, cause,
result, audit_info, 0);
result, audit_info, errno);
}
void integrity_audit_message(int audit_msgno, struct inode *inode,