On Wed, 2026-10-21 at 21:01 +0000, Jérémy Jean wrote:
>
> @@ -326,15 +329,20 @@ int ima_collect_measurement(struct ima_iint_cache
> *iint, struct file *file,
> if (!result)
> iint->flags |= IMA_COLLECTED;
> out:
> - if (result) {
> + if (result || modsig_result) {
> if (file->f_flags & O_DIRECT)
> audit_cause = "failed(directio)";
>
> take_dentry_name_snapshot(&filename, file->f_path.dentry);
>
> - integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> - filename.name.name, "collect_data",
> - audit_cause, result, 0);
> + if (modsig_result)
> + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> + filename.name.name, "collect_data",
> + "failed-modsig", modsig_result, 0);
> + if (result)
> + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> + filename.name.name, "collect_data",
> + audit_cause, result, 0);
Frederick Lawler's patch updated integrity_audit_msg() to include errno. These
calls need to be updated.
Mimi
>
> release_dentry_name_snapshot(&filename);
> }
