Re: [PATCH v4 1/2] ima: discard modsig when detached data cannot be supplied

[Jérémy Jean]

On 2026-10-24 11:39, Jérémy Jean wrote:
> ima_collect_modsig() supplies the file contents to the parsed PKCS#7
> message as detached data. If the message already contains embedded 
> data,
> pkcs7_supply_detached_data() returns -EINVAL, but IMA ignores the 
> error.
> ima_modsig_verify() then verifies the embedded data instead of the file
> being appraised.
>
> Make ima_collect_modsig() report whether the file data was supplied,
> and discard the modsig if it was not.
>
> Fixes: 15588227e086 ("ima: Collect modsig")

The public instance of Sashiko raised some relevant feedbacks for 1/2
that my local Sashiko run did not see.
I will address them in a new version.

Regards,
Jérémy