On Mon, 2026-07-27 at 17:21 -0500, Frederick Lawler wrote:
> integrity_audit_msg() wraps integrity_audit_message() such that
> error codes are hidden by passing an additional parameter to
> integrity_audit_message(). Since this is a wrapper, we can replace
> this function with integrity_audit_message() introduced in commit
> 2f845882ecd2 ("integrity: Add errno field in audit message")
>
> No functional change intended.
There's an unintentional change in ima_write_policy(), which replaces the
existing '1' with result.
>
> Signed-off-by: Frederick Lawler <[email protected]>
Is renaming integrity_audit_msg() to integrity_audit_message() actually the
right approach here? integrity_audit_message() currently has only 2 callers vs.
~20+ for integrity_audit_msg(), and the rename forces re-wrapping of every
multi-line call site since integrity_audit_message is 4 chars longer, bloating
the first patch.
Why not simply add errno to the integrity_audit_msg() definition and callers.
Patch 1 — Add errno param to integrity_audit_msg(); update its ~20+ existing
call sites with real error values. Purely semantic, needs careful per-site
review.
Patch 2 — Convert integrity_audit_message()'s 2 callers to integrity_audit_msg()
(now identical signature, trivial rename), then delete integrity_audit_message()
as dead code. Purely mechanical, trivially reviewable, no functional risk.
thanks,
Mimi
> ---
>
>
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index
> 2a0bca5543161912abe2a0236c9fcae7055e62bc..a0c1a6dd6a750220b529cc3f77c2ae5673188e11
> 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -593,9 +593,10 @@ static ssize_t ima_write_policy(struct file *file, const
> char __user *buf,
> result = ima_read_policy(data);
> } else if (ima_appraise & IMA_APPRAISE_POLICY) {
> pr_err("signed policy file (specified as an absolute pathname)
> required\n");
> - integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
> - "policy_update", "signed policy required",
> - 1, 0);
> + integrity_audit_message(AUDIT_INTEGRITY_STATUS, NULL, NULL,
> + "policy_update",
> + "signed policy required",
> + result, 0, 0);
> result = -EACCES;
> } else {
> ima_measure_raw_policy(data, datalen);
