diff options
| author | Mimi Zohar <zohar@linux.ibm.com> | 2026-03-10 21:36:44 -0400 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2026-04-01 10:16:20 -0400 |
| commit | 64c658f358ec6ed6e992d4cf05482eaa2ab4b1a4 (patch) | |
| tree | 617e697dc9120b18e8a0841024ce09f65a66aed5 /security/integrity/ima/ima_appraise.c | |
| parent | dccfbafb1f34a98898ac685e0f3f86eeaf25ecc6 (diff) | |
| download | linux-next-64c658f358ec6ed6e992d4cf05482eaa2ab4b1a4.tar.gz linux-next-64c658f358ec6ed6e992d4cf05482eaa2ab4b1a4.zip | |
ima: add regular file data hash signature version 3 support
Instead of directly verifying the signature of a file data hash,
signature v3 verifies the signature of the ima_file_id structure
containing the file data hash.
To disambiguate the signature usage, the ima_file_id structure also
includes the hash algorithm and the type of data (e.g. regular file
hash or fs-verity root hash).
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/integrity/ima/ima_appraise.c')
| -rw-r--r-- | security/integrity/ima/ima_appraise.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 5b42307ac254..8f182d808b09 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -297,7 +297,7 @@ static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint, } sig = (typeof(sig))xattr_value; - if (sig->version >= 3) { + if (sig->version > 3) { *cause = "invalid-signature-version"; *status = INTEGRITY_FAIL; break; |