Re: [PATCH v2] ima: discard modsig on detached-data binding failure

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Jérémy,

I'm so sorry for the delay in reviewing v2.  Somehow I missed it.

On Thu, 2026-09-24 at 08:55 +0000, Jérémy Jean wrote:
> ima_collect_modsig() supplies the file contents to the parsed PKCS#7
> message as detached data. If the message already contains embedded data,
> pkcs7_supply_detached_data() returns -EINVAL, but IMA discards the error.
> ima_modsig_verify() subsequently verifies that embedded data instead of
> the file being appraised.

Returning the ima_collect_modsig() error code isn't necessary to fix the bug,
but is needed to emit an audit message.  In terms of backporting, maybe only the
bug fix should be backported.

> 
> Return binding errors and discard the modsig on failure, preserving
> ordinary hashing and security.ima appraisal. Keep digest export optional:
> ML-DSA and multiple-signer messages can still verify without it. Leave
> d-modsig empty when unavailable instead of dropping the measurement.
> Audit binding errors separately so O_DIRECT does not hide their cause.

Is "binding errors" something that AI suggested?  I'm not familiar with this
terminology.  Please reword the sentence.

> 
> Fixes: 15588227e086 ("ima: Collect modsig")
> Assisted-by: LLM

At the recent "maintainers summit" it was decided to remove "Assisted-by".

> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Other than splitting the patch, it looks good.

thanks,

Mimi