Re: [PATCH v2 1/3] integrity: Replace all uses of integrity_audit_msg() with integrity_audit_message()

[Mimi Zohar <zohar@linux.ibm.com>]

On Mon, 2026-07-27 at 17:21 -0500, Frederick Lawler wrote:
> integrity_audit_msg() wraps integrity_audit_message() such that
> error codes are hidden by passing an additional parameter to
> integrity_audit_message(). Since this is a wrapper, we can replace
> this function with integrity_audit_message() introduced in commit
> 2f845882ecd2 ("integrity: Add errno field in audit message")
> 
> No functional change intended.

There's an unintentional change in ima_write_policy(), which replaces the
existing '1' with result.

> 
> Signed-off-by: Frederick Lawler <fred@cloudflare.com>

Is renaming integrity_audit_msg() to integrity_audit_message() actually the
right approach here?  integrity_audit_message() currently has only 2 callers vs.
~20+ for integrity_audit_msg(), and the rename forces re-wrapping of every
multi-line call site since integrity_audit_message is 4 chars longer, bloating
the first patch.

Why not simply add errno to the integrity_audit_msg() definition and callers.  

Patch 1 — Add errno param to integrity_audit_msg(); update its ~20+ existing
call sites with real error values. Purely semantic, needs careful per-site
review.

Patch 2 — Convert integrity_audit_message()'s 2 callers to integrity_audit_msg()
(now identical signature, trivial rename), then delete integrity_audit_message()
as dead code. Purely mechanical, trivially reviewable, no functional risk.

thanks,

Mimi

> ---
> 
>  
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index 2a0bca5543161912abe2a0236c9fcae7055e62bc..a0c1a6dd6a750220b529cc3f77c2ae5673188e11 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -593,9 +593,10 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
>  		result = ima_read_policy(data);
>  	} else if (ima_appraise & IMA_APPRAISE_POLICY) {
>  		pr_err("signed policy file (specified as an absolute pathname) required\n");
> -		integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
> -				    "policy_update", "signed policy required",
> -				    1, 0);
> +		integrity_audit_message(AUDIT_INTEGRITY_STATUS, NULL, NULL,
> +					"policy_update",
> +					"signed policy required",
> +					result, 0, 0);
>  		result = -EACCES;
>  	} else {
>  		ima_measure_raw_policy(data, datalen);