[PATCH] fsverity: Tell LSMs about signature only after verity is enabled

[Fan Wu]

On Sun, Oct 25, 2026 at 1:45 PM Eric Biggers <ebiggers at kernel.org> wrote:
>
> FS_IOC_ENABLE_VERITY calls security_inode_setintegrity() before verity
> has finished being enabled.  That's broken because enabling verity can
> still fail at that point, e.g. due to insufficient xattr space.
>
> Afterwards, arbitrary contents can be written to the file, which doesn't
> actually have verity enabled.  The in-core inode stays the same, so the
> LSM considers it to have verity enabled with a valid signature.  (Or
> rather, in the case of IPE, which is the only LSM that implements
> security_inode_setintegrity(), it also checks IS_VERITY(), which can be
> bypassed by enabling verity with no signature after the file writes.)
>
> Fix this by moving the call to security_inode_setintegrity() out of
> fsverity_verify_signature() and into a new function that is called from
> the appropriate places.
>
> Fixes: 7c373e4f1445 ("fsverity: expose verified fsverity built-in signatures to LSMs")
> Cc: stable at vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers at kernel.org>
> ---

Thanks for the fix!

Reviewed-by: Fan Wu <wufan at kernel.org>
Tested-by: Fan Wu <wufan at kernel.org>