[PATCH v3 1/2] integrity: Report error code in integrity_audit_msg() call sites
From: Frederick Lawler <hidden>
Date: 2026-09-16 21:36:53
Also in:
linux-integrity, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
integrity_audit_msg() hides error codes by wrapping integrity_audit_message() which obfuscates the underlying reason for the failure. Update integrity_audit_msg() call sites to take an error code and report errors the same as integrity_audit_message(). Signed-off-by: Frederick Lawler <redacted> --- security/integrity/evm/evm_main.c | 9 +++++---- security/integrity/ima/ima_api.c | 8 ++++---- security/integrity/ima/ima_appraise.c | 6 +++--- security/integrity/ima/ima_fs.c | 4 ++-- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 7 ++++--- security/integrity/ima/ima_policy.c | 11 ++++++----- security/integrity/ima/ima_queue.c | 2 +- security/integrity/ima/ima_template_lib.c | 2 +- security/integrity/integrity.h | 5 +++-- security/integrity/integrity_audit.c | 5 +++-- 11 files changed, 33 insertions(+), 28 deletions(-)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index b59e3f121b8a89edb14d811351ec393a69de8ff7..5be9349afcd09b47b78d1126ffc1fe341264ae6e 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c@@ -563,7 +563,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, dentry->d_inode, dentry->d_name.name, "update_metadata", integrity_status_msg[evm_status], - -EPERM, 0); + -EPERM, 0, -EPERM); } out: /* Exception if the HMAC is not going to be calculated. */
@@ -588,7 +588,7 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), dentry->d_name.name, "appraise_metadata", integrity_status_msg[evm_status], - -EPERM, 0); + -EPERM, 0, -EPERM); return evm_status == INTEGRITY_PASS ? 0 : -EPERM; }
@@ -729,7 +729,7 @@ static int evm_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), dentry->d_name.name, "appraise_metadata", integrity_status_msg[evm_status], - -EPERM, 0); + -EPERM, 0, -EPERM); return -EPERM; }
@@ -992,7 +992,8 @@ static int evm_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry, integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry), dentry->d_name.name, "appraise_metadata", - integrity_status_msg[evm_status], -EPERM, 0); + integrity_status_msg[evm_status], -EPERM, 0, + -EPERM); return -EPERM; }
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 122d127e108dcca8ddae6575c908144859783fb6..f765bfe5db68d0847cfe5b47f81b64018083f65a 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c@@ -116,7 +116,7 @@ int ima_store_template(struct ima_template_entry *entry, if (result < 0) { integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, template_name, op, - audit_cause, result, 0); + audit_cause, result, 0, result); return result; } }
@@ -159,7 +159,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, ima_free_template_entry(entry); err_out: integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, - op, cause, result, 0); + op, cause, result, 0, result); } /**
@@ -330,7 +330,7 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file, integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename.name.name, "collect_data", - audit_cause, result, 0); + audit_cause, result, 0, result); release_dentry_name_snapshot(&filename); }
@@ -383,7 +383,7 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file, result = ima_alloc_init_template(&event_data, &entry, template_desc); if (result < 0) { integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, - op, audit_cause, result, 0); + op, audit_cause, result, 0, result); return; }
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index b280488e15fcb0b6f8a8a0caaab93c7d511e4a40..6dc712f430f44ee18c3418a6bf4cd4da49758b98 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c@@ -564,7 +564,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint, status = INTEGRITY_FAIL; cause = "unverifiable-signature"; integrity_audit_msg(audit_msgno, inode, filename, - op, cause, rc, 0); + op, cause, rc, 0, rc); } else if (status != INTEGRITY_PASS) { /* Fix mode, but don't replace file signatures. */ if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
@@ -589,7 +589,7 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint, } integrity_audit_msg(audit_msgno, inode, filename, - op, cause, rc, 0); + op, cause, rc, 0, rc); } else { ima_cache_flags(iint, func); }
@@ -752,7 +752,7 @@ static int validate_hash_algo(struct dentry *dentry, path = NULL; integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path, - "set_data", errmsg, -EACCES, 0); + "set_data", errmsg, -EACCES, 0, -EACCES); kfree(pathbuf);
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 2a0bca5543161912abe2a0236c9fcae7055e62bc..6d2ef44b21f8d40b4981a6a441cf7c3d69f94dee 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c@@ -595,7 +595,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, pr_err("signed policy file (specified as an absolute pathname) required\n"); integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, "policy_update", "signed policy required", - 1, 0); + 1, 0, -EINVAL); result = -EACCES; } else { ima_measure_raw_policy(data, datalen);
@@ -745,7 +745,7 @@ static int ima_release_policy(struct inode *inode, struct file *file) pr_info("policy update %s\n", cause); integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, - "policy_update", cause, !valid_policy, 0); + "policy_update", cause, !valid_policy, 0, 0); if (!valid_policy) { ima_delete_rules();
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index d53f4d89a53e56d7ebb31950c10b37fc89782753..7a76e2686267482b10bf854a76829c60ef9f1e1b 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c@@ -103,7 +103,7 @@ static int __init ima_add_boot_aggregate(void) return 0; err_out: integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op, - audit_cause, result, 0); + audit_cause, result, 0, result); return result; }
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index ab1e53b3210d3a4d3f91d65f7db19e6a2a2d401c..9e80f40680d7be08d14d26ba48ed334d4e4ab10c 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c@@ -119,7 +119,7 @@ static int mmap_violation_check(enum ima_hooks func, struct file *file, *pathname = ima_d_path(&file->f_path, pathbuf, filename); integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, *pathname, - "mmap_file", "mmapped_writers", rc, 0); + "mmap_file", "mmapped_writers", rc, 0, rc); } return rc; }
@@ -466,7 +466,7 @@ static int process_measurement(struct file *file, const struct cred *cred, integrity_audit_msg(AUDIT_INTEGRITY_DATA, file_inode(file), pathname, "collect_data", - "denied-hash-algorithm", rc, 0); + "denied-hash-algorithm", rc, 0, rc); } out_locked: if ((mask & MAY_WRITE) && test_bit(IMA_DIGSIG, &iint->atomic_flags) &&
@@ -579,7 +579,8 @@ static int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, file = vma->vm_file; pathname = ima_d_path(&file->f_path, &pathbuf, filename); integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, pathname, - "collect_data", "failed-mprotect", result, 0); + "collect_data", "failed-mprotect", result, 0, + result); if (pathbuf) __putname(pathbuf);
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 68d9a5e6c232ea0678e9f51f105cebecccccb43e..9013c962dc0bfd6184948230ad6746e71f6e82f5 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c@@ -1992,7 +1992,8 @@ ssize_t ima_parse_add_rule(char *rule) entry = kzalloc_obj(*entry); if (!entry) { integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, - NULL, op, "-ENOMEM", -ENOMEM, audit_info); + NULL, op, "-ENOMEM", -ENOMEM, audit_info, + -ENOMEM); return -ENOMEM; }
@@ -2003,7 +2004,7 @@ ssize_t ima_parse_add_rule(char *rule) ima_free_rule(entry); integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, op, "invalid-policy", result, - audit_info); + audit_info, result); return result; }
@@ -2421,7 +2422,7 @@ void ima_measure_loaded_policy(void) rule = kmalloc(rule_len, GFP_KERNEL); if (!rule) { integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, - op, "ENOMEM", result, 0); + op, "ENOMEM", result, 0, result); return; }
@@ -2440,7 +2441,7 @@ void ima_measure_loaded_policy(void) result = -E2BIG; integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, op, "rule_length", - result, 0); + result, 0, result); rcu_read_unlock(); goto free_rule; }
@@ -2454,7 +2455,7 @@ void ima_measure_loaded_policy(void) file.buf = kmalloc(file_len, GFP_KERNEL); if (!file.buf) { integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, event_name, - op, "ENOMEM", result, 0); + op, "ENOMEM", result, 0, result); goto free_rule; }
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index f89f0ca3d4edf16a7147b3c23d25fc2cf18044c6..8d3282ff7da4131ae4389bf832442285e500542d 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c@@ -292,7 +292,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, out: mutex_unlock(&ima_extend_list_mutex); integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename, - op, audit_cause, result, audit_info); + op, audit_cause, result, audit_info, result); return result; }
diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
index 8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..9bd80ca1159a2fe24b3ea3308a118f6beea733cb 100644
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c@@ -392,7 +392,7 @@ int ima_eventdigest_init(struct ima_event_data *event_data, if (result) { integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, event_data->filename, "collect_data", - "failed", result, 0); + "failed", result, 0, result); return result; } cur_digest = hash_hdr->digest;
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 0c581c03c5da72d80e9c352a7adff1fb89628644..2ab6b7e34e7ee2dd29ae03ae1fb45fa26d9c032a 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h@@ -218,7 +218,8 @@ static inline void evm_load_x509(void) /* declarations */ void integrity_audit_msg(int audit_msgno, struct inode *inode, const unsigned char *fname, const char *op, - const char *cause, int result, int info); + const char *cause, int result, int info, + int errno); void integrity_audit_message(int audit_msgno, struct inode *inode, const unsigned char *fname, const char *op,
@@ -235,7 +236,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type) static inline void integrity_audit_msg(int audit_msgno, struct inode *inode, const unsigned char *fname, const char *op, const char *cause, - int result, int info) + int result, int info, int errno) { }
diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
index d8d9e5ff1cd22b091f462d1e83d28d2d6bd983e9..2dd2d7e3916e7bf35c753450315ff22e2d0292b7 100644
--- a/security/integrity/integrity_audit.c
+++ b/security/integrity/integrity_audit.c@@ -27,10 +27,11 @@ __setup("integrity_audit=", integrity_audit_setup); void integrity_audit_msg(int audit_msgno, struct inode *inode, const unsigned char *fname, const char *op, - const char *cause, int result, int audit_info) + const char *cause, int result, int audit_info, + int errno) { integrity_audit_message(audit_msgno, inode, fname, op, cause, - result, audit_info, 0); + result, audit_info, errno); } void integrity_audit_message(int audit_msgno, struct inode *inode,
--
2.43.0