If the FS_IOC_ENABLE_VERITY ioctl was used to enable fs-verity on a file (e.g., with the fsverity enable command), and then I want to write to that file again, how can I disable fs-verity on it? Right now, my workaround is to copy the file and then delete the original, but this is really inefficient when the file is large.
asked Dec 7, 2021 at 20:53
Add a comment
|
1 Answer
You can not do this by design. This wiki page about the rpm packages described, why.
"Once fs-verity is enabled for a given file (which, in the RPM case, happens at package installation time), it cannot be disabled, and the file becomes immutable. One can still rename() or unlink() it (and this is indeed how rpm is able to replace files when upgrading packages), but the actual contents cannot be altered."
....
"Let's say that instead the attacker mounts (or gains access to) your filesystem, unlinks /bin/ls and replaces it wholesale with a new copy (hence creating a new inode). The attacker doesn't have your signing key, so they can't resign the file and enable fs-verity on it (they could resign it with their own key, but unless they can then find a way to load its cert into the kernel keyring it won't do much good). To protect against this, you now have a few options:"
