From: Mimi Zohar Date: Wed, 11 Mar 2026 01:36:44 +0000 (-0400) Subject: ima: add regular file data hash signature version 3 support X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=64c658f358ec6ed6e992d4cf05482eaa2ab4b1a4;p=thirdparty%2Fkernel%2Flinux.git ima: add regular file data hash signature version 3 support Instead of directly verifying the signature of a file data hash, signature v3 verifies the signature of the ima_file_id structure containing the file data hash. To disambiguate the signature usage, the ima_file_id structure also includes the hash algorithm and the type of data (e.g. regular file hash or fs-verity root hash). Tested-by: Stefan Berger Acked-by: Eric Biggers Signed-off-by: Mimi Zohar --- diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c index dc53137466093..6b21b9bf829e1 100644 --- a/security/integrity/digsig_asymmetric.c +++ b/security/integrity/digsig_asymmetric.c @@ -154,7 +154,7 @@ static int calc_file_id_hash(enum evm_ima_xattr_type type, size_t file_id_size; int rc; - if (type != IMA_VERITY_DIGSIG) + if (type != IMA_VERITY_DIGSIG && type != EVM_IMA_XATTR_DIGSIG) return -EINVAL; tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0); diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 5b42307ac2541..8f182d808b096 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -297,7 +297,7 @@ static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint, } sig = (typeof(sig))xattr_value; - if (sig->version >= 3) { + if (sig->version > 3) { *cause = "invalid-signature-version"; *status = INTEGRITY_FAIL; break;