result logged in integrity audit message

[Mimi Zohar]

Hi Lakshmi,

On Fri, 2020-06-05 at 20:13 -0700, Lakshmi Ramasubramanian wrote:
> Hi Mimi,
> 
> In integrity audit message function the inverse of "result" is being 
> logged for "res=". Please see below. Is this intentional?
> 
> void integrity_audit_msg(int audit_msgno, struct inode *inode,
> 			 const unsigned char *fname, const char *op,
> 			 const char *cause, int result, int audit_info)
> {
> 
>   ...
>   audit_log_format(ab, " res=%d", !result);
> }
> 
> The callers of this function are passing an error code (-ENOMEM, 
> -EINVAL, etc.) in the "result" parameter. But that error code is lost - 
> instead "res" is set to 0.
> 
> For example,
> 
> audit: type=1804 audit(1591411737.631:3): pid=1 uid=0 auid=4294967295 
> ses=4294967295 subj=kernel op=ima_alloc_key_entry cause=ENOMEM 
> comm="swapper/0" name=".builtin_trusted_keys" res=0

The commit message provides an explanation.  Look at b0d5de4d5880 ("IMA: fix
audit res field to indicate 1 for success and 0 for failure").

Mimi