If the FS_IOC_ENABLE_VERITY ioctl was used to enable fs-verity on a file (e.g., with the fsverity enable command), and then I want to write to that file again, how can I disable fs-verity on it? Right now, my workaround is to copy the file and then delete the original, but this is really inefficient when the file is large.

1 Answer 1


You can not do this by design. This wiki page about the rpm packages described, why.
"Once fs-verity is enabled for a given file (which, in the RPM case, happens at package installation time), it cannot be disabled, and the file becomes immutable. One can still rename() or unlink() it (and this is indeed how rpm is able to replace files when upgrading packages), but the actual contents cannot be altered." ....
"Let's say that instead the attacker mounts (or gains access to) your filesystem, unlinks /bin/ls and replaces it wholesale with a new copy (hence creating a new inode). The attacker doesn't have your signing key, so they can't resign the file and enable fs-verity on it (they could resign it with their own key, but unless they can then find a way to load its cert into the kernel keyring it won't do much good). To protect against this, you now have a few options:"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.