[PATCH v3 1/2] ima: discard modsig when detached data cannot be supplied

[sashiko-bot at kernel.org]

> ima_collect_modsig() supplies the file contents to the parsed PKCS#7
> message as detached data. If the message already contains embedded data,
> pkcs7_supply_detached_data() returns -EINVAL, but IMA ignores the error.
> ima_modsig_verify() then verifies the embedded data instead of the file
> being appraised.
> 
> Make ima_collect_modsig() report whether the file data was supplied,
> and discard the modsig if it was not. 
> 
> Fixes: 15588227e086 ("ima: Collect modsig")
> Cc: stable at vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean at oss.cyber.gouv.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021210145.1851396-2-Jeremy.Jean@oss.cyber.gouv.fr?part=1