Re: [PATCH 5.15] fsverity: Explicitly require FMODE_READ to retrieve hashes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] fsverity: missing FMODE_READ check in fsverity_ioctl_enable()
--

commit 6f42601569a4e27dbe2802c031c26b860ad70602
Author: Eric Biggers <ebiggers@kernel.org>

fsverity: Explicitly require FMODE_READ to retrieve hashes

This commit requires FMODE_READ in fsverity_ioctl_measure() and
fsverity_ioctl_read_metadata() so that ioctl-only file descriptors cannot
be used to retrieve file hashes without passing LSM read-permission
checks, and documents EBADF for the fs-verity ioctls.

Link: https://patch.msgid.link/20261022211522.1489943-1-ebiggers@kernel.org

> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
> index 1d831e3cbcb33..073bb57334c45 100644
> --- a/Documentation/filesystems/fsverity.rst
> +++ b/Documentation/filesystems/fsverity.rst
> @@ -146,6 +146,7 @@ fatal signal), no changes are made to the file.
>  FS_IOC_ENABLE_VERITY can fail with the following errors:
>  
>  - ``EACCES``: the process does not have write access to the file
> +- ``EBADF``: the file descriptor is not open for reading
>  - ``EBADMSG``: the signature is malformed
>  - ``EBUSY``: this ioctl is already running on the file
>  - ``EEXIST``: the file already has verity enabled

[Severity: Medium]
Should fsverity_ioctl_enable() also check FMODE_READ in this branch?

This hunk documents EBADF for FS_IOC_ENABLE_VERITY, and the commit message
notes that ioctl-only file descriptors were already disallowed for
FS_IOC_ENABLE_VERITY, but in this branch fsverity_ioctl_enable() only
checks file_permission(filp, MAY_WRITE) and deny_write_access(filp), and
read_file_data_page() reads directly from filp->f_mapping rather than
through __kernel_read():

fs/verity/enable.c:fsverity_ioctl_enable() {
    ...
	err = file_permission(filp, MAY_WRITE);
	if (err)
		return err;
    ...
	err = deny_write_access(filp);
	if (err) /* -ETXTBSY */
		goto out_drop_write;

	err = enable_verity(filp, &arg);
    ...
}

Because an ioctl-only (access mode 3) file descriptor has neither
FMODE_READ nor FMODE_WRITE set and does not increment inode->i_writecount,
FS_IOC_ENABLE_VERITY still succeeds on an ioctl-only fd without passing
security_file_open() read/write checks in LSMs such as Landlock or
AppArmor (and fails with -ETXTBSY rather than -EBADF on a write-only fd).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107191131.30975-1-ebiggers@kernel.org?part=1