write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/fs/verity/signature.c
..
..
@@ -81,6 +81,22 @@
81
81
 		return 0;
82
82
 	}
83
83
 
84
+	if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
85
+		/*
86
+		 * The ".fs-verity" keyring is empty, due to builtin signatures
87
+		 * being supported by the kernel but not actually being used.
88
+		 * In this case, verify_pkcs7_signature() would always return an
89
+		 * error, usually ENOKEY.  It could also be EBADMSG if the
90
+		 * PKCS#7 is malformed, but that isn't very important to
91
+		 * distinguish.  So, just skip to ENOKEY to avoid the attack
92
+		 * surface of the PKCS#7 parser, which would otherwise be
93
+		 * reachable by any task able to execute FS_IOC_ENABLE_VERITY.
94
+		 */
95
+		fsverity_err(inode,
96
+			     "fs-verity keyring is empty, rejecting signed file!");
97
+		return -ENOKEY;
98
+	}
99
+
84
100
 	d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
85
101
 	if (!d)
86
102
 		return -ENOMEM;