[PATCH v4 0/2] integrity: Return error codes in audit messages

[Frederick Lawler <fred@cloudflare.com>]

Commit 2f845882ecd2 ("integrity: Add errno field in audit message")
introduced an audit log function that can take an error code. It is
wrapped by integrity_audit_msg() that implicitly sets the error code
argument to zero. The problem is that there are uses of integrity_audit_msg()
such as ima_collect_measurement() that hide the failure cause for
the message.

This series aims to clarify error reasons for failures, by exposing
error codes to the audit message.

We do this by first by extending integrity_audit_msg() to take a
errno parameter and pass that through integrity_audit_message(). Update
call sites, and finally replace integrity_audit_message()
with integrity_audit_msg() and remove integrity_audit_message().

Signed-off-by: Frederick Lawler <fred@cloudflare.com>
---
Changes in v4:
- Various patch/cover letter message changes.
- Fixes uses of return code for ima_appraise_measurement() to
  conditionally use rc as error code if rc < 0.
- Conditionally return -EINVAL for ima_release_policy() suggested by
  Enrico.
- Use -EACESS for ima_write_policy() since that would be the actual
  failure for the function. Suggested by Enrico.
- Link to v3: https://lore.kernel.org/r/20260916-report-hash-error-v3-0-73e5d95e9efe@cloudflare.com

Changes in v3:
- Condense series to two commits.
- Reduce review churn by adding error code to integrity_audit_msg().
- ima_write_policy() to report -EINVAL instead of result.
- Link to v2: https://lore.kernel.org/r/20260727-report-hash-error-v2-0-30e394f524fc@cloudflare.com

Changes in v2:
- Changes from v1 are now reflected in patch 3.
- Replace all instances of integrity_audit_msg().
- Convert to patch series.
- Link to v1: https://lore.kernel.org/r/20260716-report-hash-error-v1-1-ac19281112e4@cloudflare.com

---
Frederick Lawler (2):
      integrity: Report error code in integrity_audit_msg() call sites
      integrity: Replace integrity_audit_message() with integrity_audit_msg()

 security/integrity/evm/evm_main.c         |  9 +++++----
 security/integrity/ima/ima_api.c          |  8 ++++----
 security/integrity/ima/ima_appraise.c     |  6 +++---
 security/integrity/ima/ima_fs.c           |  7 ++++---
 security/integrity/ima/ima_init.c         |  2 +-
 security/integrity/ima/ima_main.c         | 13 +++++++------
 security/integrity/ima/ima_policy.c       | 11 ++++++-----
 security/integrity/ima/ima_queue.c        |  2 +-
 security/integrity/ima/ima_queue_keys.c   |  8 ++++----
 security/integrity/ima/ima_template_lib.c |  2 +-
 security/integrity/integrity.h            | 18 +++---------------
 security/integrity/integrity_audit.c      | 12 ++----------
 12 files changed, 41 insertions(+), 57 deletions(-)
---
base-commit: 6903878d4654bdef4e08e38cdf1ae306ce7de5f9
change-id: 20260716-report-hash-error-5203d6fe6e4e

Best regards,
-- 
Frederick Lawler <fred@cloudflare.com>