[PATCH] fsverity: Tell LSMs about signature only after verity is enabled

[sashiko-bot at kernel.org]

> FS_IOC_ENABLE_VERITY calls security_inode_setintegrity() before verity
> has finished being enabled.  That's broken because enabling verity can
> still fail at that point, e.g. due to insufficient xattr space.
> 
> Afterwards, arbitrary contents can be written to the file, which doesn't
> actually have verity enabled.  The in-core inode stays the same, so the
> LSM considers it to have verity enabled with a valid signature.  (Or
> rather, in the case of IPE, which is the only LSM that implements
> security_inode_setintegrity(), it also checks IS_VERITY(), which can be
> bypassed by enabling verity with no signature after the file writes.)
> 
> Fix this by moving the call to security_inode_setintegrity() out of
> fsverity_verify_signature() and into a new function that is called from
> the appropriate places.
> 
> Fixes: 7c373e4f1445 ("fsverity: expose verified fsverity built-in signatures to LSMs")
> Cc: stable at vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers at kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025204534.122506-1-ebiggers@kernel.org?part=1