Hi Frederick, On Wed, 2026-09-16 at 16:36 -0500, Frederick Lawler wrote: > integrity_audit_msg() hides error codes by wrapping > integrity_audit_message() which obfuscates the underlying reason for the > failure. > > Update integrity_audit_msg() call sites
here it could be mentioned that also integrity_audit_msg() itself is updated. > to take an error code and report > errors the same as integrity_audit_message(). > > Signed-off-by: Frederick Lawler <[email protected]> > --- > security/integrity/evm/evm_main.c | 9 +++++---- > security/integrity/ima/ima_api.c | 8 ++++---- > security/integrity/ima/ima_appraise.c | 6 +++--- > security/integrity/ima/ima_fs.c | 4 ++-- > security/integrity/ima/ima_init.c | 2 +- > security/integrity/ima/ima_main.c | 7 ++++--- > security/integrity/ima/ima_policy.c | 11 ++++++----- > security/integrity/ima/ima_queue.c | 2 +- > security/integrity/ima/ima_template_lib.c | 2 +- > security/integrity/integrity.h | 5 +++-- > security/integrity/integrity_audit.c | 5 +++-- > 11 files changed, 33 insertions(+), 28 deletions(-) > > diff --git a/security/integrity/evm/evm_main.c > b/security/integrity/evm/evm_main.c > index > b59e3f121b8a89edb14d811351ec393a69de8ff7..5be9349afcd09b47b78d1126ffc1fe341264 > ae6e 100644 > --- a/security/integrity/evm/evm_main.c > +++ b/security/integrity/evm/evm_main.c > @@ -563,7 +563,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, > dentry->d_inode, dentry->d_name.name, > "update_metadata", > integrity_status_msg[evm_status], > - -EPERM, 0); > + -EPERM, 0, -EPERM); > } > out: > /* Exception if the HMAC is not going to be calculated. */ > @@ -588,7 +588,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", > integrity_status_msg[evm_status], > - -EPERM, 0); > + -EPERM, 0, -EPERM); > return evm_status == INTEGRITY_PASS ? 0 : -EPERM; > } > > @@ -729,7 +729,7 @@ static int evm_inode_set_acl(struct mnt_idmap *idmap, > struct dentry *dentry, > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", > integrity_status_msg[evm_status], > - -EPERM, 0); > + -EPERM, 0, -EPERM); > return -EPERM; > } > > @@ -992,7 +992,8 @@ static int evm_inode_setattr(struct mnt_idmap *idmap, > struct dentry *dentry, > > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", > - integrity_status_msg[evm_status], -EPERM, 0); > + integrity_status_msg[evm_status], -EPERM, 0, > + -EPERM); > return -EPERM; > } > > diff --git a/security/integrity/ima/ima_api.c > b/security/integrity/ima/ima_api.c > index > 122d127e108dcca8ddae6575c908144859783fb6..f765bfe5db68d0847cfe5b47f81b64018083 > f65a 100644 > --- a/security/integrity/ima/ima_api.c > +++ b/security/integrity/ima/ima_api.c > @@ -116,7 +116,7 @@ int ima_store_template(struct ima_template_entry *entry, > if (result < 0) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, > template_name, op, > - audit_cause, result, 0); > + audit_cause, result, 0, result); > return result; > } > } > @@ -159,7 +159,7 @@ void ima_add_violation(struct file *file, const unsigned > char *filename, > ima_free_template_entry(entry); > err_out: > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, > - op, cause, result, 0); > + op, cause, result, 0, result); > } > > /** > @@ -330,7 +330,7 @@ int ima_collect_measurement(struct ima_iint_cache *iint, > struct file *file, > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, > filename.name.name, "collect_data", > - audit_cause, result, 0); > + audit_cause, result, 0, result); > > release_dentry_name_snapshot(&filename); > } > @@ -383,7 +383,7 @@ void ima_store_measurement(struct ima_iint_cache *iint, > struct file *file, > result = ima_alloc_init_template(&event_data, &entry, template_desc); > if (result < 0) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, > - op, audit_cause, result, 0); > + op, audit_cause, result, 0, result); > return; > } > > diff --git a/security/integrity/ima/ima_appraise.c > b/security/integrity/ima/ima_appraise.c > index > b280488e15fcb0b6f8a8a0caaab93c7d511e4a40..6dc712f430f44ee18c3418a6bf4cd4da4975 > 8b98 100644 > --- a/security/integrity/ima/ima_appraise.c > +++ b/security/integrity/ima/ima_appraise.c > @@ -564,7 +564,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct > ima_iint_cache *iint, > status = INTEGRITY_FAIL; > cause = "unverifiable-signature"; > integrity_audit_msg(audit_msgno, inode, filename, > - op, cause, rc, 0); > + op, cause, rc, 0, rc); > } else if (status != INTEGRITY_PASS) { > /* Fix mode, but don't replace file signatures. */ > if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig && > @@ -589,7 +589,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct > ima_iint_cache *iint, > } > > integrity_audit_msg(audit_msgno, inode, filename, > - op, cause, rc, 0); > + op, cause, rc, 0, rc); > } else { > ima_cache_flags(iint, func); > } > @@ -752,7 +752,7 @@ static int validate_hash_algo(struct dentry *dentry, > path = NULL; > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path, > - "set_data", errmsg, -EACCES, 0); > + "set_data", errmsg, -EACCES, 0, -EACCES); > > kfree(pathbuf); > > diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c > index > 2a0bca5543161912abe2a0236c9fcae7055e62bc..6d2ef44b21f8d40b4981a6a441cf7c3d69f9 > 4dee 100644 > --- a/security/integrity/ima/ima_fs.c > +++ b/security/integrity/ima/ima_fs.c > @@ -595,7 +595,7 @@ static ssize_t ima_write_policy(struct file *file, const > char __user *buf, > pr_err("signed policy file (specified as an absolute pathname) required\n"); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, > "policy_update", "signed policy required", > - 1, 0); > + 1, 0, -EINVAL); Here it could be put -EACCES as errno, being the value returned for this case. > result = -EACCES; > } else { > ima_measure_raw_policy(data, datalen); > @@ -745,7 +745,7 @@ static int ima_release_policy(struct inode *inode, struct > file *file) > > pr_info("policy update %s\n", cause); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, > - "policy_update", cause, !valid_policy, 0); > + "policy_update", cause, !valid_policy, 0, 0); Here maybe it could be put a conditional errno, based on the validity of the policy, instead of hardcoding a zero. Regards, Enrico > if (!valid_policy) { > ima_delete_rules(); > diff --git a/security/integrity/ima/ima_init.c > b/security/integrity/ima/ima_init.c > index > d53f4d89a53e56d7ebb31950c10b37fc89782753..7a76e2686267482b10bf854a76829c60ef9f > 1e1b 100644 > --- a/security/integrity/ima/ima_init.c > +++ b/security/integrity/ima/ima_init.c > @@ -103,7 +103,7 @@ static int __init ima_add_boot_aggregate(void) > return 0; > err_out: > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op, > - audit_cause, result, 0); > + audit_cause, result, 0, result); > return result; > } > > diff --git a/security/integrity/ima/ima_main.c > b/security/integrity/ima/ima_main.c > index > ab1e53b3210d3a4d3f91d65f7db19e6a2a2d401c..9e80f40680d7be08d14d26ba48ed334d4e4a > b10c 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -119,7 +119,7 @@ static int mmap_violation_check(enum ima_hooks func, > struct file *file, > *pathname = ima_d_path(&file->f_path, pathbuf, > filename); > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname, > - "mmap_file", "mmapped_writers", rc, 0); > + "mmap_file", "mmapped_writers", rc, 0, rc); > } > return rc; > } > @@ -466,7 +466,7 @@ static int process_measurement(struct file *file, const > struct cred *cred, > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, file_inode(file), > pathname, "collect_data", > - "denied-hash-algorithm", rc, 0); > + "denied-hash-algorithm", rc, 0, rc); > } > out_locked: > if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) && > @@ -579,7 +579,8 @@ static int ima_file_mprotect(struct vm_area_struct *vma, > unsigned long reqprot, > file = vma->vm_file; > pathname = ima_d_path(&file->f_path, &pathbuf, filename); > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname, > - "collect_data", "failed-mprotect", result, 0); > + "collect_data", "failed-mprotect", result, 0, > + result); > if (pathbuf) > __putname(pathbuf); > > diff --git a/security/integrity/ima/ima_policy.c > b/security/integrity/ima/ima_policy.c > index > 68d9a5e6c232ea0678e9f51f105cebecccccb43e..9013c962dc0bfd6184948230ad6746e71f6e > 82f5 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > @@ -1992,7 +1992,8 @@ ssize_t ima_parse_add_rule(char *rule) > entry = kzalloc_obj(*entry); > if (!entry) { > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, > - NULL, op, "-ENOMEM", -ENOMEM, audit_info); > + NULL, op, "-ENOMEM", -ENOMEM, audit_info, > + -ENOMEM); > return -ENOMEM; > } > > @@ -2003,7 +2004,7 @@ ssize_t ima_parse_add_rule(char *rule) > ima_free_rule(entry); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, > NULL, op, "invalid-policy", result, > - audit_info); > + audit_info, result); > return result; > } > > @@ -2421,7 +2422,7 @@ void ima_measure_loaded_policy(void) > rule = kmalloc(rule_len, GFP_KERNEL); > if (!rule) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, > - op, "ENOMEM", result, 0); > + op, "ENOMEM", result, 0, result); > return; > } > > @@ -2440,7 +2441,7 @@ void ima_measure_loaded_policy(void) > result = -E2BIG; > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, > event_name, op, "rule_length", > - result, 0); > + result, 0, result); > rcu_read_unlock(); > goto free_rule; > } > @@ -2454,7 +2455,7 @@ void ima_measure_loaded_policy(void) > file.buf = kmalloc(file_len, GFP_KERNEL); > if (!file.buf) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, > - op, "ENOMEM", result, 0); > + op, "ENOMEM", result, 0, result); > goto free_rule; > } > > diff --git a/security/integrity/ima/ima_queue.c > b/security/integrity/ima/ima_queue.c > index > f89f0ca3d4edf16a7147b3c23d25fc2cf18044c6..8d3282ff7da4131ae4389bf832442285e500 > 542d 100644 > --- a/security/integrity/ima/ima_queue.c > +++ b/security/integrity/ima/ima_queue.c > @@ -292,7 +292,7 @@ int ima_add_template_entry(struct ima_template_entry > *entry, int violation, > out: > mutex_unlock(&ima_extend_list_mutex); > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, > - op, audit_cause, result, audit_info); > + op, audit_cause, result, audit_info, result); > return result; > } > > diff --git a/security/integrity/ima/ima_template_lib.c > b/security/integrity/ima/ima_template_lib.c > index > 8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..9bd80ca1159a2fe24b3ea3308a118f6beea7 > 33cb 100644 > --- a/security/integrity/ima/ima_template_lib.c > +++ b/security/integrity/ima/ima_template_lib.c > @@ -392,7 +392,7 @@ int ima_eventdigest_init(struct ima_event_data > *event_data, > if (result) { > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, > event_data->filename, "collect_data", > - "failed", result, 0); > + "failed", result, 0, result); > return result; > } > cur_digest = hash_hdr->digest; > diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h > index > 0c581c03c5da72d80e9c352a7adff1fb89628644..2ab6b7e34e7ee2dd29ae03ae1fb45fa26d9c > 032a 100644 > --- a/security/integrity/integrity.h > +++ b/security/integrity/integrity.h > @@ -218,7 +218,8 @@ static inline void evm_load_x509(void) > /* declarations */ > void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, > - const char *cause, int result, int info); > + const char *cause, int result, int info, > + int errno); > > void integrity_audit_message(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, > @@ -235,7 +236,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t > gfp_mask, int type) > static inline void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, > const char *op, const char *cause, > - int result, int info) > + int result, int info, int errno) > { > } > > diff --git a/security/integrity/integrity_audit.c > b/security/integrity/integrity_audit.c > index > d8d9e5ff1cd22b091f462d1e83d28d2d6bd983e9..2dd2d7e3916e7bf35c753450315ff22e2d02 > 92b7 100644 > --- a/security/integrity/integrity_audit.c > +++ b/security/integrity/integrity_audit.c > @@ -27,10 +27,11 @@ __setup("integrity_audit=", integrity_audit_setup); > > void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, > - const char *cause, int result, int audit_info) > + const char *cause, int result, int audit_info, > + int errno) > { > integrity_audit_message(audit_msgno, inode, fname, op, cause, > - result, audit_info, 0); > + result, audit_info, errno); > } > > void integrity_audit_message(int audit_msgno, struct inode *inode,
