From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: zohar@linux.ibm.com, sgrubb@redhat.com, paul@paul-moore.com
Cc: linux-integrity@vger.kernel.org, linux-audit@redhat.com
Subject: [PATCH] field-dictionary.csv: Add errno to audit message field dictionary
Date: Sun, 9 Aug 2020 18:02:10 -0700 [thread overview]
Message-ID: <20200810010210.4037-1-nramas@linux.microsoft.com> (raw)
Error code was not included in the audit messages logged by
the integrity subsystem in the Linux kernel.
commit 2f845882ecd2 in https://github.com/torvalds/linux tree added
"errno" field in the audit messages logged by the integrity subsystem.
The "errno" field will be set to 0 when the operation was completed
successfully, and on failure a non-zero error code is set in this field
in the audit message.
Add the documentation for the "errno" field in the audit message
field dictionary.
Sample audit message from the integrity subsystem with errno field:
[ 6.303048] audit: type=1804 audit(1592506281.627:2): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel op=measuring_key cause=ENOMEM comm="swapper/0" name=".builtin_trusted_keys" res=0 errno=-12
Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
specs/fields/field-dictionary.csv | 1 +
1 file changed, 1 insertion(+)
diff --git a/specs/fields/field-dictionary.csv b/specs/fields/field-dictionary.csv
index 055ff79..5117e25 100644
--- a/specs/fields/field-dictionary.csv
+++ b/specs/fields/field-dictionary.csv
@@ -49,6 +49,7 @@ dport,numeric,remote port number,
egid,numeric,effective group ID,
enforcing,numeric,new MAC enforcement status,
entries,numeric,number of entries in the netfilter table,
+errno,numeric,error code of the audited operation,
euid,numeric,effective user ID,
exe,encoded,executable name,
exit,numeric,syscall exit code,
--
2.28.0
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next reply other threads:[~2020-08-10 1:17 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-10 1:02 Lakshmi Ramasubramanian [this message]
2020-08-12 0:53 ` [PATCH] field-dictionary.csv: Add errno to audit message field dictionary Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200810010210.4037-1-nramas@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=linux-audit@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=sgrubb@redhat.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).