On 2026-10-24 11:39, Jérémy Jean wrote:
ima_collect_modsig() supplies the file contents to the parsed PKCS#7
message as detached data. If the message already contains embedded
data,
pkcs7_supply_detached_data() returns -EINVAL, but IMA ignores the
error.
ima_modsig_verify() then verifies the embedded data instead of the file
being appraised.
Make ima_collect_modsig() report whether the file data was supplied,
and discard the modsig if it was not.
Fixes: 15588227e086 ("ima: Collect modsig")
The public instance of Sashiko raised some relevant feedbacks for 1/2
that my local Sashiko run did not see.
I will address them in a new version.
Regards,
Jérémy
