Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
added a check to return an error if ret_val != 0, before ret_val is
later used in a log message. Now it will unconditionally print "...
res=0". So don't print res anymore.
Addresses-Coverity: ("Dead code")
Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
Signed-off-by: Alex Dewar <[email protected]>
---
I wasn't sure whether it was intended that something other than ret_val
be printed in the log, so that's why I'm sending this as an RFC.
net/netlabel/netlabel_domainhash.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index f73a8382c275..526762b2f3a9 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
if (audit_buf != NULL) {
audit_log_format(audit_buf,
- " nlbl_domain=%s res=%u",
- entry->domain ? entry->domain : "(default)",
- ret_val == 0 ? 1 : 0);
+ " nlbl_domain=%s",
+ entry->domain ? entry->domain : "(default)");
audit_log_end(audit_buf);
}
--
2.28.0
On Thu, Aug 27, 2020 at 12:39 PM Alex Dewar <[email protected]> wrote:
>
> Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> added a check to return an error if ret_val != 0, before ret_val is
> later used in a log message. Now it will unconditionally print "...
> res=0". So don't print res anymore.
>
> Addresses-Coverity: ("Dead code")
> Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> Signed-off-by: Alex Dewar <[email protected]>
> ---
>
> I wasn't sure whether it was intended that something other than ret_val
> be printed in the log, so that's why I'm sending this as an RFC.
It's intentional for a couple of reasons:
* The people who care about audit logs like to see success/fail (e.g.
"res=X") for audit events/records, so printing this out gives them the
warm fuzzies.
* For a lot of awful reasons that I won't bore you with, we really
don't want to add/remove fields in the middle of an audit record so we
pretty much need to keep the "res=0" there even if it seems a bit
redundant.
So NACK from me, but thanks for paying attention just the same :)
> net/netlabel/netlabel_domainhash.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
> index f73a8382c275..526762b2f3a9 100644
> --- a/net/netlabel/netlabel_domainhash.c
> +++ b/net/netlabel/netlabel_domainhash.c
> @@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
> audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
> if (audit_buf != NULL) {
> audit_log_format(audit_buf,
> - " nlbl_domain=%s res=%u",
> - entry->domain ? entry->domain : "(default)",
> - ret_val == 0 ? 1 : 0);
> + " nlbl_domain=%s",
> + entry->domain ? entry->domain : "(default)");
> audit_log_end(audit_buf);
> }
>
--
paul moore
http://www.paul-moore.com
On Thu, Aug 27, 2020 at 01:00:58PM -0400, Paul Moore wrote:
> On Thu, Aug 27, 2020 at 12:39 PM Alex Dewar <[email protected]> wrote:
> >
> > Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > added a check to return an error if ret_val != 0, before ret_val is
> > later used in a log message. Now it will unconditionally print "...
> > res=0". So don't print res anymore.
> >
> > Addresses-Coverity: ("Dead code")
> > Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > Signed-off-by: Alex Dewar <[email protected]>
> > ---
> >
> > I wasn't sure whether it was intended that something other than ret_val
> > be printed in the log, so that's why I'm sending this as an RFC.
>
> It's intentional for a couple of reasons:
>
> * The people who care about audit logs like to see success/fail (e.g.
> "res=X") for audit events/records, so printing this out gives them the
> warm fuzzies.
>
> * For a lot of awful reasons that I won't bore you with, we really
> don't want to add/remove fields in the middle of an audit record so we
> pretty much need to keep the "res=0" there even if it seems a bit
> redundant.
>
> So NACK from me, but thanks for paying attention just the same :)
Would you rather just have an explicit "res=0" in there, without looking
at ret_val? The thing is that ret_val will *always* be zero at this point in
the code, because, if not, the function will already have returned.
That's why Coverity flagged it up as a redundant check.
>
> > net/netlabel/netlabel_domainhash.c | 5 ++---
> > 1 file changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
> > index f73a8382c275..526762b2f3a9 100644
> > --- a/net/netlabel/netlabel_domainhash.c
> > +++ b/net/netlabel/netlabel_domainhash.c
> > @@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
> > audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
> > if (audit_buf != NULL) {
> > audit_log_format(audit_buf,
> > - " nlbl_domain=%s res=%u",
> > - entry->domain ? entry->domain : "(default)",
> > - ret_val == 0 ? 1 : 0);
> > + " nlbl_domain=%s",
> > + entry->domain ? entry->domain : "(default)");
> > audit_log_end(audit_buf);
> > }
> >
>
> --
> paul moore
> http://www.paul-moore.com
On Thu, Aug 27, 2020 at 06:06:34PM +0100, Alex Dewar wrote:
> On Thu, Aug 27, 2020 at 01:00:58PM -0400, Paul Moore wrote:
> > On Thu, Aug 27, 2020 at 12:39 PM Alex Dewar <[email protected]> wrote:
> > >
> > > Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > > added a check to return an error if ret_val != 0, before ret_val is
> > > later used in a log message. Now it will unconditionally print "...
> > > res=0". So don't print res anymore.
> > >
> > > Addresses-Coverity: ("Dead code")
> > > Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > > Signed-off-by: Alex Dewar <[email protected]>
> > > ---
> > >
> > > I wasn't sure whether it was intended that something other than ret_val
> > > be printed in the log, so that's why I'm sending this as an RFC.
> >
> > It's intentional for a couple of reasons:
> >
> > * The people who care about audit logs like to see success/fail (e.g.
> > "res=X") for audit events/records, so printing this out gives them the
> > warm fuzzies.
> >
> > * For a lot of awful reasons that I won't bore you with, we really
> > don't want to add/remove fields in the middle of an audit record so we
> > pretty much need to keep the "res=0" there even if it seems a bit
> > redundant.
> >
> > So NACK from me, but thanks for paying attention just the same :)
>
> Would you rather just have an explicit "res=0" in there, without looking
> at ret_val? The thing is that ret_val will *always* be zero at this point in
> the code, because, if not, the function will already have returned.
> That's why Coverity flagged it up as a redundant check.
Sorry, I meant "res=1". The code will always print res=1, because
ret_val is always 0.
>
> >
> > > net/netlabel/netlabel_domainhash.c | 5 ++---
> > > 1 file changed, 2 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
> > > index f73a8382c275..526762b2f3a9 100644
> > > --- a/net/netlabel/netlabel_domainhash.c
> > > +++ b/net/netlabel/netlabel_domainhash.c
> > > @@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
> > > audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
> > > if (audit_buf != NULL) {
> > > audit_log_format(audit_buf,
> > > - " nlbl_domain=%s res=%u",
> > > - entry->domain ? entry->domain : "(default)",
> > > - ret_val == 0 ? 1 : 0);
> > > + " nlbl_domain=%s",
> > > + entry->domain ? entry->domain : "(default)");
> > > audit_log_end(audit_buf);
> > > }
> > >
> >
> > --
> > paul moore
> > http://www.paul-moore.com
On Thu, Aug 27, 2020 at 1:20 PM Alex Dewar <[email protected]> wrote:
> On Thu, Aug 27, 2020 at 06:06:34PM +0100, Alex Dewar wrote:
> > On Thu, Aug 27, 2020 at 01:00:58PM -0400, Paul Moore wrote:
> > > On Thu, Aug 27, 2020 at 12:39 PM Alex Dewar <[email protected]> wrote:
> > > >
> > > > Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > > > added a check to return an error if ret_val != 0, before ret_val is
> > > > later used in a log message. Now it will unconditionally print "...
> > > > res=0". So don't print res anymore.
> > > >
> > > > Addresses-Coverity: ("Dead code")
> > > > Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> > > > Signed-off-by: Alex Dewar <[email protected]>
> > > > ---
> > > >
> > > > I wasn't sure whether it was intended that something other than ret_val
> > > > be printed in the log, so that's why I'm sending this as an RFC.
> > >
> > > It's intentional for a couple of reasons:
> > >
> > > * The people who care about audit logs like to see success/fail (e.g.
> > > "res=X") for audit events/records, so printing this out gives them the
> > > warm fuzzies.
> > >
> > > * For a lot of awful reasons that I won't bore you with, we really
> > > don't want to add/remove fields in the middle of an audit record so we
> > > pretty much need to keep the "res=0" there even if it seems a bit
> > > redundant.
> > >
> > > So NACK from me, but thanks for paying attention just the same :)
> >
> > Would you rather just have an explicit "res=0" in there, without looking
> > at ret_val? The thing is that ret_val will *always* be zero at this point in
> > the code, because, if not, the function will already have returned.
> > That's why Coverity flagged it up as a redundant check.
>
> Sorry, I meant "res=1". The code will always print res=1, because
> ret_val is always 0.
That's okay, I can't tell you how many times I've made that mistake
with "res=" :)
Anyway, yes at that point ret_val should always be 0, and "res=X"
should always be "res=1", so if you wanted to change it to a fixed
value so you could get rid of the ternary statement that would be
okay.
> > > > net/netlabel/netlabel_domainhash.c | 5 ++---
> > > > 1 file changed, 2 insertions(+), 3 deletions(-)
> > > >
> > > > diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
> > > > index f73a8382c275..526762b2f3a9 100644
> > > > --- a/net/netlabel/netlabel_domainhash.c
> > > > +++ b/net/netlabel/netlabel_domainhash.c
> > > > @@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
> > > > audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
> > > > if (audit_buf != NULL) {
> > > > audit_log_format(audit_buf,
> > > > - " nlbl_domain=%s res=%u",
> > > > - entry->domain ? entry->domain : "(default)",
> > > > - ret_val == 0 ? 1 : 0);
> > > > + " nlbl_domain=%s",
> > > > + entry->domain ? entry->domain : "(default)");
> > > > audit_log_end(audit_buf);
> > > > }
> > > >
--
paul moore
http://www.paul-moore.com
Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
added a check to return an error if ret_val != 0, before ret_val is
later used in a log message. Now it will unconditionally print "...
res=1". So just drop the check.
Addresses-Coverity: ("Dead code")
Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
Signed-off-by: Alex Dewar <[email protected]>
---
v2: Still print the res field, because it's useful (Paul)
net/netlabel/netlabel_domainhash.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index f73a8382c275e..dc8c39f51f7d3 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
if (audit_buf != NULL) {
audit_log_format(audit_buf,
- " nlbl_domain=%s res=%u",
- entry->domain ? entry->domain : "(default)",
- ret_val == 0 ? 1 : 0);
+ " nlbl_domain=%s res=1",
+ entry->domain ? entry->domain : "(default)");
audit_log_end(audit_buf);
}
--
2.28.0
On Fri, Aug 28, 2020 at 9:56 AM Alex Dewar <[email protected]> wrote:
>
> Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> added a check to return an error if ret_val != 0, before ret_val is
> later used in a log message. Now it will unconditionally print "...
> res=1". So just drop the check.
>
> Addresses-Coverity: ("Dead code")
> Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> Signed-off-by: Alex Dewar <[email protected]>
> ---
> v2: Still print the res field, because it's useful (Paul)
>
> net/netlabel/netlabel_domainhash.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
Thanks Alex.
Acked-by: Paul Moore <[email protected]>
> diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
> index f73a8382c275e..dc8c39f51f7d3 100644
> --- a/net/netlabel/netlabel_domainhash.c
> +++ b/net/netlabel/netlabel_domainhash.c
> @@ -612,9 +612,8 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
> audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
> if (audit_buf != NULL) {
> audit_log_format(audit_buf,
> - " nlbl_domain=%s res=%u",
> - entry->domain ? entry->domain : "(default)",
> - ret_val == 0 ? 1 : 0);
> + " nlbl_domain=%s res=1",
> + entry->domain ? entry->domain : "(default)");
> audit_log_end(audit_buf);
> }
>
> --
> 2.28.0
>
--
paul moore
http://www.paul-moore.com
From: Alex Dewar <[email protected]>
Date: Fri, 28 Aug 2020 14:55:23 +0100
> Commit d3b990b7f327 ("netlabel: fix problems with mapping removal")
> added a check to return an error if ret_val != 0, before ret_val is
> later used in a log message. Now it will unconditionally print "...
> res=1". So just drop the check.
>
> Addresses-Coverity: ("Dead code")
> Fixes: d3b990b7f327 ("netlabel: fix problems with mapping removal")
> Signed-off-by: Alex Dewar <[email protected]>
> ---
> v2: Still print the res field, because it's useful (Paul)
Applied to net-next, thank you.