Re: [PATCH v3 2/2] ima: audit failure to supply detached data for modsig

[Jérémy Jean]

On 2026-10-23 19:36, Mimi Zohar wrote:
> On Wed, 2026-10-21 at 21:01 +0000, Jérémy Jean wrote:
> >
>
> > @@ -326,15 +329,20 @@ int ima_collect_measurement(struct 
> > ima_iint_cache *iint, struct file *file,
> >  	if (!result)
> >  		iint->flags |= IMA_COLLECTED;
> >  out:
> > -	if (result) {
> > +	if (result || modsig_result) {
> >  		if (file->f_flags & O_DIRECT)
> >  			audit_cause = "failed(directio)";
> >
> >  		take_dentry_name_snapshot(&filename, file->f_path.dentry);
> >
> > -		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> > -				    filename.name.name, "collect_data",
> > -				    audit_cause, result, 0);
> > +		if (modsig_result)
> > +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> > +					    filename.name.name, "collect_data",
> > +					    "failed-modsig", modsig_result, 0);
> > +		if (result)
> > +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
> > +					    filename.name.name, "collect_data",
> > +					    audit_cause, result, 0);
>
>
> Frederick Lawler's patch updated integrity_audit_msg() to include 
> errno.  These
> calls need to be updated.

Indeed, thanks for this.
I have just sent out a new version to take this and your other remark 
into
consideration.

Best,
Jérémy