Re: [PATCH v3 2/2] ima: audit failure to supply detached data for modsig

[Mimi Zohar]

On Wed, 2026-10-21 at 21:01 +0000, Jérémy Jean wrote:
> 

> @@ -326,15 +329,20 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
>  	if (!result)
>  		iint->flags |= IMA_COLLECTED;
>  out:
> -	if (result) {
> +	if (result || modsig_result) {
>  		if (file->f_flags & O_DIRECT)
>  			audit_cause = "failed(directio)";
>  
>  		take_dentry_name_snapshot(&filename, file->f_path.dentry);
>  
> -		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> -				    filename.name.name, "collect_data",
> -				    audit_cause, result, 0);
> +		if (modsig_result)
> +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> +					    filename.name.name, "collect_data",
> +					    "failed-modsig", modsig_result, 0);
> +		if (result)
> +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> +					    filename.name.name, "collect_data",
> +					    audit_cause, result, 0);


Frederick Lawler's patch updated integrity_audit_msg() to include errno.  These
calls need to be updated.

Mimi

>  
>  		release_dentry_name_snapshot(&filename);
>  	}