Re: [PATCH v3 2/2] ima: audit failure to supply detached data for modsig

[Jérémy Jean]

On 2026-10-23 19:36, Mimi Zohar wrote:
On Wed, 2026-10-21 at 21:01 +0000, Jérémy Jean wrote:


@@ -326,15 +329,20 @@ int ima_collect_measurement(struct 
ima_iint_cache *iint, struct file *file,
        if (!result)
                iint->flags |= IMA_COLLECTED;
 out:
-       if (result) {
+       if (result || modsig_result) {
                if (file->f_flags & O_DIRECT)
                        audit_cause = "failed(directio)";

                take_dentry_name_snapshot(&filename, file->f_path.dentry);

-               integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
-                                   filename.name.name, "collect_data",
-                                   audit_cause, result, 0);
+               if (modsig_result)
+                       integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
+                                           filename.name.name, "collect_data",
+                                           "failed-modsig", modsig_result, 0);
+               if (result)
+                       integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
+                                           filename.name.name, "collect_data",
+                                           audit_cause, result, 0);


Frederick Lawler's patch updated integrity_audit_msg() to include 
errno.  These
calls need to be updated.

Indeed, thanks for this.
I have just sent out a new version to take this and your other remark 
into
consideration.

Best,
Jérémy