Re: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature

> From: Deven Bowers [mailto:deven.desai@linux.microsoft.com] > Sent: Friday, October 15, 2021 9:26 PM > On 10/13/2021 12:24 PM, Eric Biggers wrote: >> On Wed, Oct 13, 2021 at 12:06:31PM -0700, > deven.desai(a)linux.microsoft.com wrote: >>> From: Fan Wu <wufan(a)linux.microsoft.com&gt; >>> >>> Add security_inode_setsecurity to fsverity signature verification. >>> This can let LSMs save the signature data and digest hashes provided >>> by fsverity. >> Can you elaborate on why LSMs need this information? > The proposed LSM (IPE) of this series will be the only one to need > this information at the  moment. IPE’s goal is to have provide > trust-based access control. Trust and Integrity are tied together, > as you cannot prove trust without proving integrity. I wanted to go back on this question. It seems, at least for fsverity, that you could obtain the root digest at run-time, without storing it in a security blob. I thought I should use fsverity_get_info() but the fsverity_info structure is not exported (it is defined in fs/verity/fsverity_private.h). Then, I defined a new function, fsverity_get_file_digest() to copy the file_digest member of fsverity_info to a buffer and to pass the associated hash algorithm. With that, the code of evaluate() for DIGLIM becomes: info = fsverity_get_info(file_inode(ctx->file)); if (info) ret = fsverity_get_file_digest(info, buffer, sizeof(buffer), &algo); if (!strcmp(expect->data, "diglim") && ret > 0) { ret = diglim_digest_get_info(buffer, algo, COMPACT_FILE, &modifiers, &actions); if (!ret) return true; }