ima: Report errno for failed hash collection to audit

[PATCH] ima: Report errno for failed hash collection to audit

Posted by Frederick Lawler 1 week, 2 days ago

integrity_audit_msg() wraps integrity_audit_message() such that errno is
always set to zero. When debugging for failed hashes, it'd be nice to
understand the corresponding error code with the cause.

Signed-off-by: Frederick Lawler <fred@cloudflare.com>
---
 security/integrity/ima/ima_api.c          | 6 +++---
 security/integrity/ima/ima_template_lib.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 122d127e108dcca8ddae6575c908144859783fb6..15883e4f077e0aa950f3fdd4b573873929da68aa 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -328,9 +328,9 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
 
 		take_dentry_name_snapshot(&filename, file->f_path.dentry);
 
-		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
-				    filename.name.name, "collect_data",
-				    audit_cause, result, 0);
+		integrity_audit_message(AUDIT_INTEGRITY_DATA, inode,
+					filename.name.name, "collect_data",
+					audit_cause, result, 0, result);
 
 		release_dentry_name_snapshot(&filename);
 	}
diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
index 8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..6d163312fb4c47ce256766e997aac5f7375088a8 100644
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c
@@ -390,9 +390,9 @@ int ima_eventdigest_init(struct ima_event_data *event_data,
 	    ima_hash_algo : HASH_ALGO_SHA1;
 	result = ima_calc_file_hash(event_data->file, hash_hdr);
 	if (result) {
-		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
-				    event_data->filename, "collect_data",
-				    "failed", result, 0);
+		integrity_audit_message(AUDIT_INTEGRITY_DATA, inode,
+					event_data->filename, "collect_data",
+					"failed", result, 0, result);
 		return result;
 	}
 	cur_digest = hash_hdr->digest;

---
base-commit: 1da739feb31b4fecae465ebf87ba44a97e44101b
change-id: 20260716-report-hash-error-5203d6fe6e4e

Best regards,
-- 
Frederick Lawler <fred@cloudflare.com>

Re: [PATCH] ima: Report errno for failed hash collection to audit

Posted by Mimi Zohar 1 day, 20 hours ago

Hi Frederick,

On Thu, 2026-07-16 at 14:10 -0500, Frederick Lawler wrote:
> integrity_audit_msg() wraps integrity_audit_message() such that errno is
> always set to zero. When debugging for failed hashes, it'd be nice to
> understand the corresponding error code with the cause.
> 
> Signed-off-by: Frederick Lawler <fred@cloudflare.com>

This patch looks fine.  Any chance you have time to look at the remaining IMA
calls to integrity_audit_msg() and fix them as well?

thanks,

Mimi

Re: [PATCH] ima: Report errno for failed hash collection to audit

Posted by Frederick Lawler 1 day, 19 hours ago

Hi Mimi,

On Fri, Jul 24, 2026 at 04:34:07PM -0400, Mimi Zohar wrote:
> Hi Frederick,
> 
> On Thu, 2026-07-16 at 14:10 -0500, Frederick Lawler wrote:
> > integrity_audit_msg() wraps integrity_audit_message() such that errno is
> > always set to zero. When debugging for failed hashes, it'd be nice to
> > understand the corresponding error code with the cause.
> > 
> > Signed-off-by: Frederick Lawler <fred@cloudflare.com>
> 
> This patch looks fine.  Any chance you have time to look at the remaining IMA
> calls to integrity_audit_msg() and fix them as well?

Not a problem.

Best,
Fred