Re: [PATCH v3 2/2] ima: audit failure to supply detached data for modsig

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-10-23 19:36, Mimi Zohar wrote:
> On Wed, 2026-10-21 at 21:01 +0000, Jérémy Jean wrote:
>> 
> 
>> @@ -326,15 +329,20 @@ int ima_collect_measurement(struct 
>> ima_iint_cache *iint, struct file *file,
>>  	if (!result)
>>  		iint->flags |= IMA_COLLECTED;
>>  out:
>> -	if (result) {
>> +	if (result || modsig_result) {
>>  		if (file->f_flags & O_DIRECT)
>>  			audit_cause = "failed(directio)";
>> 
>>  		take_dentry_name_snapshot(&filename, file->f_path.dentry);
>> 
>> -		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
>> -				    filename.name.name, "collect_data",
>> -				    audit_cause, result, 0);
>> +		if (modsig_result)
>> +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
>> +					    filename.name.name, "collect_data",
>> +					    "failed-modsig", modsig_result, 0);
>> +		if (result)
>> +			integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
>> +					    filename.name.name, "collect_data",
>> +					    audit_cause, result, 0);
> 
> 
> Frederick Lawler's patch updated integrity_audit_msg() to include 
> errno.  These
> calls need to be updated.

Indeed, thanks for this.
I have just sent out a new version to take this and your other remark 
into
consideration.

Best,
Jérémy