Hi Frederick, On September 24, 2026 10:34:58 PM GMT+02:00, Frederick Lawler <[email protected]> wrote: >integrity_audit_msg() hides error codes by wrapping >integrity_audit_message() which obfuscates the underlying reason for the >failure. > >Update integrity_audit_msg() to take a errno argument, and pass that >through to integrity_audit_message(). Then update call sites to >take caller's respective error codes. > >ima_appraise_measurement() stores xattr_len as the return code, but >can replace it with a error code later. Therefore conditionally use >a code if rc < 0, otherwise report zero. Lastly, conditionally use >-EINVAL for ima_release_policy(). > >Signed-off-by: Frederick Lawler <[email protected]>
Reviewed-by: Enrico Bravi <[email protected]> Regards, Enrico >--- > security/integrity/evm/evm_main.c | 9 +++++---- > security/integrity/ima/ima_api.c | 8 ++++---- > security/integrity/ima/ima_appraise.c | 6 +++--- > security/integrity/ima/ima_fs.c | 7 ++++--- > security/integrity/ima/ima_init.c | 2 +- > security/integrity/ima/ima_main.c | 7 ++++--- > security/integrity/ima/ima_policy.c | 11 ++++++----- > security/integrity/ima/ima_queue.c | 2 +- > security/integrity/ima/ima_template_lib.c | 2 +- > security/integrity/integrity.h | 5 +++-- > security/integrity/integrity_audit.c | 5 +++-- > 11 files changed, 35 insertions(+), 29 deletions(-) > >diff --git a/security/integrity/evm/evm_main.c >b/security/integrity/evm/evm_main.c >index >b59e3f121b8a89edb14d811351ec393a69de8ff7..5be9349afcd09b47b78d1126ffc1fe341264ae6e > 100644 >--- a/security/integrity/evm/evm_main.c >+++ b/security/integrity/evm/evm_main.c >@@ -563,7 +563,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, > dentry->d_inode, dentry->d_name.name, > "update_metadata", > integrity_status_msg[evm_status], >- -EPERM, 0); >+ -EPERM, 0, -EPERM); > } > out: > /* Exception if the HMAC is not going to be calculated. */ >@@ -588,7 +588,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, > d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", > integrity_status_msg[evm_status], >- -EPERM, 0); >+ -EPERM, 0, -EPERM); > return evm_status == INTEGRITY_PASS ? 0 : -EPERM; > } > >@@ -729,7 +729,7 @@ static int evm_inode_set_acl(struct mnt_idmap *idmap, >struct dentry *dentry, > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, > d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", > integrity_status_msg[evm_status], >- -EPERM, 0); >+ -EPERM, 0, -EPERM); > return -EPERM; > } > >@@ -992,7 +992,8 @@ static int evm_inode_setattr(struct mnt_idmap *idmap, >struct dentry *dentry, > > integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), > dentry->d_name.name, "appraise_metadata", >- integrity_status_msg[evm_status], -EPERM, 0); >+ integrity_status_msg[evm_status], -EPERM, 0, >+ -EPERM); > return -EPERM; > } > >diff --git a/security/integrity/ima/ima_api.c >b/security/integrity/ima/ima_api.c >index >122d127e108dcca8ddae6575c908144859783fb6..f765bfe5db68d0847cfe5b47f81b64018083f65a > 100644 >--- a/security/integrity/ima/ima_api.c >+++ b/security/integrity/ima/ima_api.c >@@ -116,7 +116,7 @@ int ima_store_template(struct ima_template_entry *entry, > if (result < 0) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, > template_name, op, >- audit_cause, result, 0); >+ audit_cause, result, 0, result); > return result; > } > } >@@ -159,7 +159,7 @@ void ima_add_violation(struct file *file, const unsigned >char *filename, > ima_free_template_entry(entry); > err_out: > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, >- op, cause, result, 0); >+ op, cause, result, 0, result); > } > > /** >@@ -330,7 +330,7 @@ int ima_collect_measurement(struct ima_iint_cache *iint, >struct file *file, > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, > filename.name.name, "collect_data", >- audit_cause, result, 0); >+ audit_cause, result, 0, result); > > release_dentry_name_snapshot(&filename); > } >@@ -383,7 +383,7 @@ void ima_store_measurement(struct ima_iint_cache *iint, >struct file *file, > result = ima_alloc_init_template(&event_data, &entry, template_desc); > if (result < 0) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, >- op, audit_cause, result, 0); >+ op, audit_cause, result, 0, result); > return; > } > >diff --git a/security/integrity/ima/ima_appraise.c >b/security/integrity/ima/ima_appraise.c >index >b280488e15fcb0b6f8a8a0caaab93c7d511e4a40..84c4dee2323cf7352cccd8e4c9291d0fb6eed8e1 > 100644 >--- a/security/integrity/ima/ima_appraise.c >+++ b/security/integrity/ima/ima_appraise.c >@@ -564,7 +564,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct >ima_iint_cache *iint, > status = INTEGRITY_FAIL; > cause = "unverifiable-signature"; > integrity_audit_msg(audit_msgno, inode, filename, >- op, cause, rc, 0); >+ op, cause, rc, 0, rc < 0 ? rc : 0); > } else if (status != INTEGRITY_PASS) { > /* Fix mode, but don't replace file signatures. */ > if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig && >@@ -589,7 +589,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct >ima_iint_cache *iint, > } > > integrity_audit_msg(audit_msgno, inode, filename, >- op, cause, rc, 0); >+ op, cause, rc, 0, rc < 0 ? rc : 0); > } else { > ima_cache_flags(iint, func); > } >@@ -752,7 +752,7 @@ static int validate_hash_algo(struct dentry *dentry, > path = NULL; > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path, >- "set_data", errmsg, -EACCES, 0); >+ "set_data", errmsg, -EACCES, 0, -EACCES); > > kfree(pathbuf); > >diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c >index >2a0bca5543161912abe2a0236c9fcae7055e62bc..3b8174a91a3451128c0b182e852875d5b73d3efb > 100644 >--- a/security/integrity/ima/ima_fs.c >+++ b/security/integrity/ima/ima_fs.c >@@ -592,11 +592,11 @@ static ssize_t ima_write_policy(struct file *file, const >char __user *buf, > if (data[0] == '/') { > result = ima_read_policy(data); > } else if (ima_appraise & IMA_APPRAISE_POLICY) { >+ result = -EACCES; > pr_err("signed policy file (specified as an absolute pathname) > required\n"); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, > "policy_update", "signed policy required", >- 1, 0); >- result = -EACCES; >+ result, 0, result); > } else { > ima_measure_raw_policy(data, datalen); > result = ima_parse_add_rule(data); >@@ -745,7 +745,8 @@ static int ima_release_policy(struct inode *inode, struct >file *file) > > pr_info("policy update %s\n", cause); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, >- "policy_update", cause, !valid_policy, 0); >+ "policy_update", cause, !valid_policy, 0, >+ !valid_policy ? -EINVAL : 0); > > if (!valid_policy) { > ima_delete_rules(); >diff --git a/security/integrity/ima/ima_init.c >b/security/integrity/ima/ima_init.c >index >d53f4d89a53e56d7ebb31950c10b37fc89782753..7a76e2686267482b10bf854a76829c60ef9f1e1b > 100644 >--- a/security/integrity/ima/ima_init.c >+++ b/security/integrity/ima/ima_init.c >@@ -103,7 +103,7 @@ static int __init ima_add_boot_aggregate(void) > return 0; > err_out: > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op, >- audit_cause, result, 0); >+ audit_cause, result, 0, result); > return result; > } > >diff --git a/security/integrity/ima/ima_main.c >b/security/integrity/ima/ima_main.c >index >ab1e53b3210d3a4d3f91d65f7db19e6a2a2d401c..9e80f40680d7be08d14d26ba48ed334d4e4ab10c > 100644 >--- a/security/integrity/ima/ima_main.c >+++ b/security/integrity/ima/ima_main.c >@@ -119,7 +119,7 @@ static int mmap_violation_check(enum ima_hooks func, >struct file *file, > *pathname = ima_d_path(&file->f_path, pathbuf, > filename); > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname, >- "mmap_file", "mmapped_writers", rc, 0); >+ "mmap_file", "mmapped_writers", rc, 0, rc); > } > return rc; > } >@@ -466,7 +466,7 @@ static int process_measurement(struct file *file, const >struct cred *cred, > > integrity_audit_msg(AUDIT_INTEGRITY_DATA, file_inode(file), > pathname, "collect_data", >- "denied-hash-algorithm", rc, 0); >+ "denied-hash-algorithm", rc, 0, rc); > } > out_locked: > if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) && >@@ -579,7 +579,8 @@ static int ima_file_mprotect(struct vm_area_struct *vma, >unsigned long reqprot, > file = vma->vm_file; > pathname = ima_d_path(&file->f_path, &pathbuf, filename); > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname, >- "collect_data", "failed-mprotect", result, 0); >+ "collect_data", "failed-mprotect", result, 0, >+ result); > if (pathbuf) > __putname(pathbuf); > >diff --git a/security/integrity/ima/ima_policy.c >b/security/integrity/ima/ima_policy.c >index >68d9a5e6c232ea0678e9f51f105cebecccccb43e..9013c962dc0bfd6184948230ad6746e71f6e82f5 > 100644 >--- a/security/integrity/ima/ima_policy.c >+++ b/security/integrity/ima/ima_policy.c >@@ -1992,7 +1992,8 @@ ssize_t ima_parse_add_rule(char *rule) > entry = kzalloc_obj(*entry); > if (!entry) { > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, >- NULL, op, "-ENOMEM", -ENOMEM, audit_info); >+ NULL, op, "-ENOMEM", -ENOMEM, audit_info, >+ -ENOMEM); > return -ENOMEM; > } > >@@ -2003,7 +2004,7 @@ ssize_t ima_parse_add_rule(char *rule) > ima_free_rule(entry); > integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, > NULL, op, "invalid-policy", result, >- audit_info); >+ audit_info, result); > return result; > } > >@@ -2421,7 +2422,7 @@ void ima_measure_loaded_policy(void) > rule = kmalloc(rule_len, GFP_KERNEL); > if (!rule) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, >- op, "ENOMEM", result, 0); >+ op, "ENOMEM", result, 0, result); > return; > } > >@@ -2440,7 +2441,7 @@ void ima_measure_loaded_policy(void) > result = -E2BIG; > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, > event_name, op, "rule_length", >- result, 0); >+ result, 0, result); > rcu_read_unlock(); > goto free_rule; > } >@@ -2454,7 +2455,7 @@ void ima_measure_loaded_policy(void) > file.buf = kmalloc(file_len, GFP_KERNEL); > if (!file.buf) { > integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, >- op, "ENOMEM", result, 0); >+ op, "ENOMEM", result, 0, result); > goto free_rule; > } > >diff --git a/security/integrity/ima/ima_queue.c >b/security/integrity/ima/ima_queue.c >index >f89f0ca3d4edf16a7147b3c23d25fc2cf18044c6..8d3282ff7da4131ae4389bf832442285e500542d > 100644 >--- a/security/integrity/ima/ima_queue.c >+++ b/security/integrity/ima/ima_queue.c >@@ -292,7 +292,7 @@ int ima_add_template_entry(struct ima_template_entry >*entry, int violation, > out: > mutex_unlock(&ima_extend_list_mutex); > integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, >- op, audit_cause, result, audit_info); >+ op, audit_cause, result, audit_info, result); > return result; > } > >diff --git a/security/integrity/ima/ima_template_lib.c >b/security/integrity/ima/ima_template_lib.c >index >8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..9bd80ca1159a2fe24b3ea3308a118f6beea733cb > 100644 >--- a/security/integrity/ima/ima_template_lib.c >+++ b/security/integrity/ima/ima_template_lib.c >@@ -392,7 +392,7 @@ int ima_eventdigest_init(struct ima_event_data *event_data, > if (result) { > integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, > event_data->filename, "collect_data", >- "failed", result, 0); >+ "failed", result, 0, result); > return result; > } > cur_digest = hash_hdr->digest; >diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h >index >0c581c03c5da72d80e9c352a7adff1fb89628644..2ab6b7e34e7ee2dd29ae03ae1fb45fa26d9c032a > 100644 >--- a/security/integrity/integrity.h >+++ b/security/integrity/integrity.h >@@ -218,7 +218,8 @@ static inline void evm_load_x509(void) > /* declarations */ > void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, >- const char *cause, int result, int info); >+ const char *cause, int result, int info, >+ int errno); > > void integrity_audit_message(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, >@@ -235,7 +236,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t >gfp_mask, int type) > static inline void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, > const char *op, const char *cause, >- int result, int info) >+ int result, int info, int errno) > { > } > >diff --git a/security/integrity/integrity_audit.c >b/security/integrity/integrity_audit.c >index >d8d9e5ff1cd22b091f462d1e83d28d2d6bd983e9..2dd2d7e3916e7bf35c753450315ff22e2d0292b7 > 100644 >--- a/security/integrity/integrity_audit.c >+++ b/security/integrity/integrity_audit.c >@@ -27,10 +27,11 @@ __setup("integrity_audit=", integrity_audit_setup); > > void integrity_audit_msg(int audit_msgno, struct inode *inode, > const unsigned char *fname, const char *op, >- const char *cause, int result, int audit_info) >+ const char *cause, int result, int audit_info, >+ int errno) > { > integrity_audit_message(audit_msgno, inode, fname, op, cause, >- result, audit_info, 0); >+ result, audit_info, errno); > } > > void integrity_audit_message(int audit_msgno, struct inode *inode, >
