From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f173.google.com (mail-yw1-f173.google.com [209.85.128.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34594421A07 for ; Thu, 16 Jul 2026 19:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784229063; cv=none; b=E0cvxw8jyujv56FV42M4l5tyC84brdcSg1x1K22XooWRiPAA2DhKBPwdNap1cn4sCko4b6HOy98rbCi4+SXZ1xjj2+8A/+qcSKPfWZNmQYpxARjVPm+ZvNik/WG/ZN+i7jOHv7q05Zgz7D0tpQmiec5vRR7pt16wWUWVY+ODCIo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784229063; c=relaxed/simple; bh=6rQO5dLbgGRQ+1ZAuu7llJFe1zRdMpO/COtyJ3jbmRY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=iFLQMvFQG7Qs29HWsgUckEOPW55YhWjKqAt2Ik43D7Cdr8o1x6wKahz6IxpXViDaI0qiHW4T43XcoEjXSul0J2BzghIAQ/wk0zYcwMmymgCkczOpkiWuEbZmrvQ6JUBAUFIJzE/N/VQhrq9pM+CKTUSwnG4s00yP7phtOiOyhPA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=aL4NfT/w; arc=none smtp.client-ip=209.85.128.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="aL4NfT/w" Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-81ee2c048acso12028977b3.3 for ; Thu, 16 Jul 2026 12:11:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1784229060; x=1784833860; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=R6zePSti7ASS1ok69EYQ+PkxSi0XpyrM1Y8fQpPG17Q=; b=aL4NfT/w2DTQM/eRc8mJt1DiZrPKt36EYfo8Vf8TvmSlrntB7TA9Za6CfURrW75Hqs dHnueMjIl+6wRJf4EuwEOvWLxdiKLU3ZUW30rQb3d023/0N5htfodWORkSIVFgCMEf2g xt2DP2eA6kVu8iJOlLj5WaS+JH9m/teMe3Y0VqN3Cu5yXHgkYw4Ek7SSza5eeOXbwDy7 AUsEH9Dl7HNYg2KBW7AcBjr/S39Pt9x5t5sWcZddhxpORtd2ouvVU/wLhQrMeqlZv2Gb Bmh03fFkjJcc2Bxjw67RHpclI414TP5QSxlrbppijIcmqnnT40HCZlCtahscI4snjuPG bP4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784229060; x=1784833860; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=R6zePSti7ASS1ok69EYQ+PkxSi0XpyrM1Y8fQpPG17Q=; b=VsTDspnWEkfVo1wOSt4p+dwO49htwx2ai7wHmeAhQeiUVY3G778jmmE3m6ViUBakds vel93Ny6C8M/pqtdhNsFarBKxo255YhC91p1ULvQVCplnFKgu3Tj9r1WkmBldgztsTzQ LQ0GHlrknAohuAuJAHP6gwb+vZ5g6Ovn5X486P0Gwxtvyn00zHBfgBV8u/E5TdK9yW8p CMc1hzkVMjziCUyqgW3Bp3wHG7idvnqLe5JdCejyEwEnNLrNAcxW+fNcbUoTB7y9q4F8 i6qBLnfc1Agh6YAp3YxiPXhyZsFZA/Jx1onTnZpZxTLWhecQq3rF5kd6eRO8m/3o6lY2 MIGQ== X-Forwarded-Encrypted: i=1; AHgh+RpyAy74P4MQuTnubehHyMJ+mcON49MIZCz/qsz60lpl8yrhFHzC0hmAgKUDHwvXRYYut3S2Aj51N8Qkl9w=@vger.kernel.org X-Gm-Message-State: AOJu0YyrqIT+ph3EhCf4gcXKo3V4U4o3JYAS7iOD6OXyVOQ8AaYXH1w6 fbuQtsq4/WRpEaoRGziHyEu1A58Ge+ul9/vGJH00lgjexalTecfiX8VtDRfCAuwjAH0= X-Gm-Gg: AfdE7cnw/0FtMMjiifcB0CzCwW0Fc7eZ5DFCQ7M3WxPFEWk34hIDiqv7L3ESie0Ja3p m/6heLILrMUwgCgXVk7WYyaM19ys/tlcZeY1CilzPk1/3Ld1FMgxOA+40pRwd2I6XlCvluxUbLi CaS0Uv8Jq2Gsd7lr/JIuS36CQLzO5SDd8tgPj08u2wu0ZqEdi7EOwO3bSazMu081Qwd/QNymPJm KDrYxAjIpe376HjyRFBhmWI8pkPT/M3E4UATB2YpOL9x+9QDRCn4jatzV8FPtd48a+pxgeuxcvK htujaYwSZOLvwT55VCJeQ+yXcjsgIpSQsRBJpxakqOMN7iuBnFSseLO2iOIhd/9vqXIqiDqGqOE CJCkdcIie1/do/biqdRtJ7SIOLZCfD5f9HKcpOjtqx6zT2WfOLadtUlhvdz/qxw== X-Received: by 2002:a05:690c:b89:b0:81e:6c2e:f112 with SMTP id 00721157ae682-81ebb143827mr99516067b3.29.1784229059946; Thu, 16 Jul 2026 12:10:59 -0700 (PDT) Received: from [127.0.1.1] ([2a09:bac6:947f:3af::5e:5d]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81e6c1feb43sm203389297b3.40.2026.07.16.12.10.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 12:10:58 -0700 (PDT) From: Frederick Lawler Date: Thu, 16 Jul 2026 14:10:52 -0500 Subject: [PATCH] ima: Report errno for failed hash collection to audit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260716-report-hash-error-v1-1-ac19281112e4@cloudflare.com> X-B4-Tracking: v=1; b=H4sIALssWWoC/x3MMQqAMBAF0avI1i4kUSN4FbEQ/ZptjGxEBMndD ZavmHkpQQWJhuolxS1J4lFg64qWMB87WNZicsZ501vPijPqxWFOgaEalTtnmtVv8GhBpTsVmzz /c5xy/gA2KUeiYwAAAA== X-Change-ID: 20260716-report-hash-error-5203d6fe6e4e To: Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Eric Snowberg , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@cloudflare.com, Frederick Lawler X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2177; i=fred@cloudflare.com; h=from:subject:message-id; bh=6rQO5dLbgGRQ+1ZAuu7llJFe1zRdMpO/COtyJ3jbmRY=; b=owEBbQKS/ZANAwAKAasltHYDktNtAcsmYgBqWSzBUkGz1q/QWLeGB1fUyWH3Z64mEUvXwOwq4 rEqWEqSD5iJAjMEAAEKAB0WIQTLNBqMVmu1PHvjOe2rJbR2A5LTbQUCalkswQAKCRCrJbR2A5LT bX1kD/0TA2W9QxMW7K02h4WlhGcpConfF15FeMjj9TZ9OPmdJk1Fes35cjdNx9np9ZH09pwiqo6 a7kOX4Rcku9DkXALke+HytAruvoN6aKsHVsloyD4YUBHzA6dxoKnC8mKabwYk8sV2y+nU2dTFDT 2PCFtVKCGA9yrLXi6vXOgl/+7ObSVhJPnB4A3wzamyYw9o43U6pbh6RzHbAMGuEvL1B5PnrGIgT Zq0tcPLTJhgK1IC2BBDHNHPvSu7Rylz2YYIMAFcvnxBlrYSADon8/pwksT4KvD5TskblzMbS6Cx Ef7QfFtq9+3jN72kdB2n3brzW8lupYhV+cmBSiPBOpqZBwRDfPWCklDe1AXk8KcZxmiKZRDvbk8 Ox3OJ28L+im7SQ5fg+Za2pnxZzfGr9uBNkePSbYDGxTmF8+W/t2jdLGPK+p2R4XvghMpLTDT2el 4DqBpN+FIcEE/7rkuomWimoxHvHb65n7LO3PQATzQdL7VZKIFF7sdjDn6AjBRgyaim/7GBB1K7N /v9CfdB5SpphXmglVM8yb3Ll09meRUc2S/OEAQV6LMw0QKXjEsG8e9CxLAgLJBHSAk72sJicq86 +Jth6lPe39EkCyjsxLQP9EMsoPt4EPxAsJmLt8hUllNMIJcGH2lsX4UTicjv/V2nmWSfl8WgRUs dK9Z3IZjEKvyUAA== X-Developer-Key: i=fred@cloudflare.com; a=openpgp; fpr=CB341A8C566BB53C7BE339EDAB25B4760392D36D integrity_audit_msg() wraps integrity_audit_message() such that errno is always set to zero. When debugging for failed hashes, it'd be nice to understand the corresponding error code with the cause. Signed-off-by: Frederick Lawler --- security/integrity/ima/ima_api.c | 6 +++--- security/integrity/ima/ima_template_lib.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 122d127e108dcca8ddae6575c908144859783fb6..15883e4f077e0aa950f3fdd4b573873929da68aa 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -328,9 +328,9 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file, take_dentry_name_snapshot(&filename, file->f_path.dentry); - integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, - filename.name.name, "collect_data", - audit_cause, result, 0); + integrity_audit_message(AUDIT_INTEGRITY_DATA, inode, + filename.name.name, "collect_data", + audit_cause, result, 0, result); release_dentry_name_snapshot(&filename); } diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 8a89236f926c10af0dd2b2ef08fbe59bd8a78b66..6d163312fb4c47ce256766e997aac5f7375088a8 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -390,9 +390,9 @@ int ima_eventdigest_init(struct ima_event_data *event_data, ima_hash_algo : HASH_ALGO_SHA1; result = ima_calc_file_hash(event_data->file, hash_hdr); if (result) { - integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, - event_data->filename, "collect_data", - "failed", result, 0); + integrity_audit_message(AUDIT_INTEGRITY_DATA, inode, + event_data->filename, "collect_data", + "failed", result, 0, result); return result; } cur_digest = hash_hdr->digest; --- base-commit: 1da739feb31b4fecae465ebf87ba44a97e44101b change-id: 20260716-report-hash-error-5203d6fe6e4e Best regards, -- Frederick Lawler