Re: [PATCH 6.12] fsverity: Tell LSMs about signature only after verity is enabled

[sashiko-bot@kernel.org]

> commit 28d74059fddbd8ae83c7715056b303c402071f6f upstream.
> 
> FS_IOC_ENABLE_VERITY calls security_inode_setintegrity() before verity
> has finished being enabled.  That's broken because enabling verity can
> still fail at that point, e.g. due to insufficient xattr space.
> 
> Afterwards, arbitrary contents can be written to the file, which doesn't
> actually have verity enabled.  The in-core inode stays the same, so the
> LSM considers it to have verity enabled with a valid signature.  (Or
> rather, in the case of IPE, which is the only LSM that implements
> security_inode_setintegrity(), it also checks IS_VERITY(), which can be
> bypassed by enabling verity with no signature after the file writes.)
> 
> Fix this by moving the call to security_inode_setintegrity() out of
> fsverity_verify_signature() and into a new function that is called from
> the appropriate places.
> 
> Fixes: 7c373e4f1445 ("fsverity: expose verified fsverity built-in signatures to LSMs")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fan Wu <wufan@kernel.org>
> Tested-by: Fan Wu <wufan@kernel.org>
> Link: https://patch.msgid.link/20261025204534.122506-1-ebiggers@kernel.org
> (6.12: resolved conflicts with this version storing the fsverity_info
>  pointer in the inode instead of using a hash table)
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107193513.54738-1-ebiggers@kernel.org?part=1