Hi Mimi, In integrity audit message function the inverse of "result" is being logged for "res=". Please see below. Is this intentional? void integrity_audit_msg(int audit_msgno, struct inode *inode, const unsigned char *fname, const char *op, const char *cause, int result, int audit_info) { ... audit_log_format(ab, " res=%d", !result); } The callers of this function are passing an error code (-ENOMEM, -EINVAL, etc.) in the "result" parameter. But that error code is lost - instead "res" is set to 0. For example, audit: type=1804 audit(1591411737.631:3): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel op=ima_alloc_key_entry cause=ENOMEM comm="swapper/0" name=".builtin_trusted_keys" res=0 thanks, -lakshmi