Re: [PATCH 08/13] ipe: handle errors from resolving the real inode

[Fan Wu <wufan@kernel.org>]

On 11/15/2026 6:01 AM, Christian Brauner wrote:

...

> 
> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> index 4a7be96c84f03..3751963509df4 100644
> --- a/security/ipe/eval.c
> +++ b/security/ipe/eval.c
> @@ -102,7 +102,11 @@ void ipe_build_eval_ctx(struct ipe_eval_ctx *ctx,
>  
>  	if (file) {
>  		build_ipe_sb_ctx(ctx, file);
> -		ino = d_real_inode(file->f_path.dentry);
> +		ino = d_real_data_inode(file->f_path.dentry);
> +		if (IS_ERR(ino)) {
> +			ctx->file_err = PTR_ERR(ino);
> +			return;
> +		}
>  		build_ipe_bdev_ctx(ctx, ino);
>  		build_ipe_inode_ctx(ctx, ino);


I think we only need to change this part like:

	/*
	 * If the real data inode cannot be resolved, leave the bdev
	 * and inode fields unset so the file is evaluated without
	 * dm-verity/fs-verity state.
	 */
	ino = d_real_data_inode(file->f_path.dentry);
	if (!IS_ERR(ino)) {
		build_ipe_bdev_ctx(ctx, ino);
		build_ipe_inode_ctx(ctx, ino);
	}


This also avoids the missing audit issue noted by the bpf bot, and we
don't need to add file_err to struct ipe_eval_ctx.

With the above change, feel free to add:

Acked-by: Fan Wu <wufan@kernel.org>

Fan

>  	}
> @@ -335,6 +339,15 @@ int ipe_evaluate_event(const struct ipe_eval_ctx *const ctx)
>  		return 0;
>  	}
>  
> +	/*
> +	 * Without the inode hosting the data none of the properties of the
> +	 * file can be evaluated. Refuse it unless IPE is permissive.
> +	 */
> +	if (ctx->file_err) {
> +		rcu_read_unlock();
> +		return READ_ONCE(enforce) ? -EACCES : 0;
> +	}
> +
>  	if (ctx->op == IPE_OP_INVALID) {
>  		if (pol->parsed->global_default_action == IPE_ACTION_INVALID) {
>  			WARN(1, "no default rule set for unknown op, ALLOW it");
> diff --git a/security/ipe/eval.h b/security/ipe/eval.h
> index b26d1147d0708..58ca50987b2b5 100644
> --- a/security/ipe/eval.h
> +++ b/security/ipe/eval.h
> @@ -42,6 +42,7 @@ struct ipe_eval_ctx {
>  	enum ipe_hook_type hook;
>  
>  	const struct file *file;
> +	int file_err;
>  	bool initramfs;
>  #ifdef CONFIG_IPE_PROP_DM_VERITY
>  	const struct ipe_bdev *ipe_bdev;
>