diff --git a/fs/attr.c b/fs/attr.c
index d22e8187477fa77350c003d73a446284c02383bb..322e5e887ecea2c2e5bc85705e91cb9375a2ba00 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -227,7 +227,7 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
 {
 	struct inode *inode = dentry->d_inode;
 	umode_t mode = inode->i_mode;
-	int error;
+	int error, evm_error;
 	struct timespec64 now;
 	unsigned int ia_valid = attr->ia_valid;
 
@@ -326,6 +326,9 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
 	error = security_inode_setattr(dentry, attr);
 	if (error)
 		return error;
+	evm_error = evm_inode_setattr(dentry, attr);
+	if (evm_error)
+		return evm_error;
 	error = try_break_deleg(inode, delegated_inode);
 	if (error)
 		return error;
diff --git a/fs/xattr.c b/fs/xattr.c
index 470ee0af32007ff0811da6e8f31ac259c14a1db4..a0e4e77f78b1764328a14d9585fe7992b13abed6 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -182,6 +182,7 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
 			fsnotify_xattr(dentry);
 			security_inode_post_setxattr(dentry, name, value,
 						     size, flags);
+			evm_inode_post_setxattr(dentry, name, value, size);
 		}
 	} else {
 		if (unlikely(is_bad_inode(inode)))
@@ -221,7 +222,7 @@ __vfs_setxattr_locked(struct dentry *dentry, const char *name,
 		struct inode **delegated_inode)
 {
 	struct inode *inode = dentry->d_inode;
-	int error;
+	int error, evm_error;
 
 	error = xattr_permission(inode, name, MAY_WRITE);
 	if (error)
@@ -231,6 +232,12 @@ __vfs_setxattr_locked(struct dentry *dentry, const char *name,
 	if (error)
 		goto out;
 
+	evm_error = evm_inode_setxattr(dentry, name, value, size);
+	if (evm_error) {
+		error = evm_error;
+		goto out;
+	}
+
 	error = try_break_deleg(inode, delegated_inode);
 	if (error)
 		goto out;
@@ -428,7 +435,7 @@ __vfs_removexattr_locked(struct dentry *dentry, const char *name,
 		struct inode **delegated_inode)
 {
 	struct inode *inode = dentry->d_inode;
-	int error;
+	int error, evm_error;
 
 	error = xattr_permission(inode, name, MAY_WRITE);
 	if (error)
@@ -438,6 +445,12 @@ __vfs_removexattr_locked(struct dentry *dentry, const char *name,
 	if (error)
 		goto out;
 
+	evm_error = evm_inode_removexattr(dentry, name);
+	if (evm_error) {
+		error = evm_error;
+		goto out;
+	}
+
 	error = try_break_deleg(inode, delegated_inode);
 	if (error)
 		goto out;
diff --git a/security/security.c b/security/security.c
index 9478444bf93f71e5473d1f55e172ee409e98c508..17e2bed11bf715ad8bdfa21dd16febd6061542a6 100644
--- a/security/security.c
+++ b/security/security.c
@@ -706,14 +706,9 @@ int security_inode_permission(struct inode *inode, int mask)
 
 int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
 {
-	int ret;
-
 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
 		return 0;
-	ret = call_int_hook(inode_setattr, 0, dentry, attr);
-	if (ret)
-		return ret;
-	return evm_inode_setattr(dentry, attr);
+	return call_int_hook(inode_setattr, 0, dentry, attr);
 }
 EXPORT_SYMBOL_GPL(security_inode_setattr);
 
@@ -742,10 +737,7 @@ int security_inode_setxattr(struct dentry *dentry, const char *name,
 		ret = cap_inode_setxattr(dentry, name, value, size, flags);
 	if (ret)
 		return ret;
-	ret = ima_inode_setxattr(dentry, name, value, size);
-	if (ret)
-		return ret;
-	return evm_inode_setxattr(dentry, name, value, size);
+	return ima_inode_setxattr(dentry, name, value, size);
 }
 
 void security_inode_post_setxattr(struct dentry *dentry, const char *name,
@@ -754,7 +746,6 @@ void security_inode_post_setxattr(struct dentry *dentry, const char *name,
 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
 		return;
 	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
-	evm_inode_post_setxattr(dentry, name, value, size);
 }
 
 int security_inode_getxattr(struct dentry *dentry, const char *name)
@@ -786,10 +777,7 @@ int security_inode_removexattr(struct dentry *dentry, const char *name)
 		ret = cap_inode_removexattr(dentry, name);
 	if (ret)
 		return ret;
-	ret = ima_inode_removexattr(dentry, name);
-	if (ret)
-		return ret;
-	return evm_inode_removexattr(dentry, name);
+	return ima_inode_removexattr(dentry, name);
 }
 
 int security_inode_need_killpriv(struct dentry *dentry)