Re: [PATCH] fsverity: Update misleading comment in fsverity_ioctl_read_metadata()

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Oct 22, 2026 at 11:17:26AM +0200, Andrey Albershteyn wrote:
> On 2026-10-21 22:40:30, Eric Biggers wrote:
> > The comment in fsverity_ioctl_read_metadata(), which justifies not
> > checking for FMODE_READ, doesn't consider that the nonstandard access
> > mode 3 (ioctl-only) exists.
> > 
> > It's reasonable to continue to allow this ioctl in that case, since this
> > *is* an ioctl, and opening a file with mode 3 checks for read (and
> > write) access.  However, adjust the comment to not be misleading.
> > 
> > Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> 
> Looks good to me
> Reviewed-by: Andrey Albershteyn <aalbersh@kernel.org>

Thanks.  I'm actually reconsidering this patch, though:

* This ioctl returns hashes of file contents blocks, which reveal
  information that normally a read would be needed for.

* "opening a file with mode 3 checks for read (and write) access"
  is true for the DAC permissions, but it's not true for some LSMs such
  as Landlock where it bypasses their read permission check.

So requiring FMODE_READ for this might be the way to go.

- Eric