ima: differentiate between EVM failures in the audit log

Differentiate between an invalid EVM portable signature failure
from other EVM HMAC/signature failures.

Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 940695e7b5356d5692784c78ac5b1fe8cd3b010b..ef9dcfce45d45c45ebddbba47f293ed5903fa28a 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -422,7 +422,8 @@ int ima_appraise_measurement(enum ima_hooks func,
                goto out;
        case INTEGRITY_FAIL_IMMUTABLE:
                set_bit(IMA_DIGSIG, &iint->atomic_flags);
-               fallthrough;
+               cause = "invalid-fail-immutable";
+               goto out;
        case INTEGRITY_FAIL:            /* Invalid HMAC/signature. */
                cause = "invalid-HMAC";
                goto out;