Re: [PATCH] ima: reject modsig if detached data cannot be supplied

[Mimi Zohar <zohar@linux.ibm.com>]

On Mon, 2026-08-24 at 12:00 -0400, Mimi Zohar wrote:
> On Sat, 2026-08-22 at 08:24 +0000, Jérémy Jean wrote:
> > ima_collect_modsig() binds the file being appraised to the parsed PKCS#7
> > message with pkcs7_supply_detached_data().  If the message already contains
> > embedded data, the helper returns -EINVAL.  However, ima_collect_modsig()
> > silently returns because its return type is void.
> > 
> > ima_modsig_verify() subsequently calls verify_pkcs7_message_sig() with a
> > NULL data pointer.  That verifies the embedded PKCS#7 data instead of the
> > file being appraised.  An attacker can therefore take a valid
> > detached signature, insert the original signed bytes as embedded content
> > without the private key, and append the resulting message to an unrelated
> > file.  IMA accepts the unrelated file.
> > 
> > This bypasses the module authenticity boundary when an IMA modsig appraisal
> > rule is enforced while CONFIG_MODULE_SIG is disabled.
> > 
> > Return detached-data binding errors and stop measurement collection when
> > binding fails.  Keep digest extraction optional because algorithms such as
> > ML-DSA can verify the message directly.  Appraisal then rejects the file
> > rather than reaching verification with embedded content active.
> > 
> > Fixes: 15588227e086 ("ima: Collect modsig")
> > Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> > Assisted-by: Codex:gpt-5
> > ---

[...]
 
> >  static inline int ima_get_modsig_digest(const struct modsig *modsig,
> > diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
> > index 122d127e108d..e2b167f24778 100644
> > --- a/security/integrity/ima/ima_api.c
> > +++ b/security/integrity/ima/ima_api.c
> > @@ -262,8 +262,11 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
> >  	 * the file digest without collecting the modsig in a previous
> >  	 * measurement rule.
> >  	 */
> > -	if (modsig)
> > -		ima_collect_modsig(modsig, buf, size);
> > +	if (modsig) {
> > +		result = ima_collect_modsig(modsig, buf, size);
> > +		if (result)
> > +			goto out;
> > +	
> 
> The normal processing of getting the xattr needs to continue even if the
> appended signatures doesn't exist.  Exiting here is too early. Consider saving
> the result as a different variable and returning an error later, if needed.

By going to "out", the file will not be properly measured, nor would the file be
appraised based on security.ima xattr.  A better solution would be to free
modsig and continue as if there wasn't an appended signature.

thanks,

Mimi