Re: [PATCH 5.10] fsverity: Explicitly require FMODE_READ to retrieve hashes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] fsverity: missing FMODE_READ check in fsverity_ioctl_enable()
  on 5.10
--

commit 4872a24e7ea173685e43d575a8bbd21a70702f93
Author: Eric Biggers <ebiggers@kernel.org>

fsverity: Explicitly require FMODE_READ to retrieve hashes

This commit backports the FMODE_READ requirement for FS_IOC_MEASURE_VERITY
and updates the fs-verity documentation for EBADF error returns.

Link: https://patch.msgid.link/20261022211522.1489943-1-ebiggers@kernel.org

> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
> index 895e9711ed881..4bd6f25e1a4b3 100644
> --- a/Documentation/filesystems/fsverity.rst
> +++ b/Documentation/filesystems/fsverity.rst
> @@ -146,6 +146,7 @@ fatal signal), no changes are made to the file.
>  FS_IOC_ENABLE_VERITY can fail with the following errors:
>  
>  - ``EACCES``: the process does not have write access to the file
> +- ``EBADF``: the file descriptor is not open for reading

[Severity: Medium]
Does fsverity_ioctl_enable() actually check FMODE_READ or return -EBADF in
5.10?

Upstream commit 04839139213c ("fsverity: reject FS_IOC_ENABLE_VERITY on
mode 3 fds"), which added the FMODE_READ check to fsverity_ioctl_enable(),
has not been backported to 5.10:

fs/verity/enable.c:fsverity_ioctl_enable() {
	...
	err = file_permission(filp, MAY_WRITE);
	if (err)
		return err;
	...
	err = deny_write_access(filp);
	if (err) /* -ETXTBSY */
		goto out_drop_write;

	err = enable_verity(filp, &arg);
	...
}

Without that commit, FS_IOC_ENABLE_VERITY fails with -ETXTBSY rather than
-EBADF on writable file descriptors, and still allows ioctl-only (access
mode 3) file descriptors to proceed without FMODE_READ.  Consequently, an
ioctl-only fd opened without LSM read/write checks in security_file_open()
can still read the file contents to build the Merkle tree and enable
verity on the file.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107191408.43437-1-ebiggers@kernel.org?part=1