[RFC,v14,15/19] fsverity: consume builtin signature via LSM hook

Commit Message

Fan Wu March 6, 2024, 11:34 p.m. UTC

fsverity represents a mechanism to support both integrity and
authenticity protection of a file, supporting both signed and unsigned
digests.

An LSM which controls access to a resource based on authenticity and
integrity of said resource, can then use this data to make an informed
decision on the authorization (provided by the LSM's policy) of said
claim.

This effectively allows the extension of a policy enforcement layer in
LSM for fsverity, allowing for more granular control of how a
particular authenticity claim can be used. For example, "all (built-in)
signed fsverity files should be allowed to execute, but only these
hashes are allowed to be loaded as kernel modules".

This enforcement must be done in kernel space, as a userspace only
solution would fail a simple litmus test: Download a self-contained
malicious binary that never touches the userspace stack. This
binary would still be able to execute.

Signed-off-by: Deven Bowers <[e-mail]>
Signed-off-by: Fan Wu <[e-mail]>

---
v1-v6:
  + Not present

v7:
  Introduced

v8:
  + Split fs/verity/ changes and security/ changes into separate patches
  + Change signature of fsverity_create_info to accept non-const inode
  + Change signature of fsverity_verify_signature to accept non-const inode
  + Don't cast-away const from inode.
  + Digest functionality dropped in favor of:
    ("fs-verity: define a function to return the integrity protected
      file digest")
  + Reworded commit description and title to match changes.
  + Fix a bug wherein no LSM implements the particular fsverity @name
    (or LSM is disabled), and returns -EOPNOTSUPP, causing errors.

v9:
  + No changes

v10:
  + Rename the signature blob key
  + Cleanup redundant code
  + Make the hook call depends on CONFIG_FS_VERITY_BUILTIN_SIGNATURES

v11:
  + No changes

v12:
  + Add constification to the hook call

v13:
  + No changes

v14:
  + Add doc/comment to built-in signature verification
---
 Documentation/filesystems/fsverity.rst |  4 +++-
 fs/verity/fsverity_private.h           |  2 +-
 fs/verity/open.c                       | 26 +++++++++++++++++++++++++-
 fs/verity/signature.c                  |  4 +++-
 include/linux/fsverity.h               |  2 ++
 5 files changed, 34 insertions(+), 4 deletions(-)

Comments

Eric Biggers March 12, 2024, 2:57 a.m. UTC | #1

On Wed, Mar 06, 2024 at 03:34:40PM -0800, Fan Wu wrote:
> fsverity represents a mechanism to support both integrity and
> authenticity protection of a file, supporting both signed and unsigned
> digests.
> 
> An LSM which controls access to a resource based on authenticity and
> integrity of said resource, can then use this data to make an informed
> decision on the authorization (provided by the LSM's policy) of said
> claim.
> 
> This effectively allows the extension of a policy enforcement layer in
> LSM for fsverity, allowing for more granular control of how a
> particular authenticity claim can be used. For example, "all (built-in)
> signed fsverity files should be allowed to execute, but only these
> hashes are allowed to be loaded as kernel modules".
> 
> This enforcement must be done in kernel space, as a userspace only
> solution would fail a simple litmus test: Download a self-contained
> malicious binary that never touches the userspace stack. This
> binary would still be able to execute.
> 
> Signed-off-by: Deven Bowers <[e-mail]>
> Signed-off-by: Fan Wu <[e-mail]>

As I've said before, this commit message needs some work.  It currently doesn't
say anything about what the patch actually does.

BTW, please make sure you're Cc'ing the fsverity mailing list
([e-mail]), not fscrypt ([e-mail]).

> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
> index 13e4b18e5dbb..64618a6141ab 100644
> --- a/Documentation/filesystems/fsverity.rst
> +++ b/Documentation/filesystems/fsverity.rst
> @@ -461,7 +461,9 @@ Enabling this option adds the following:
>  
>  3. A new sysctl "fs.verity.require_signatures" is made available.
>     When set to 1, the kernel requires that all verity files have a
> -   correctly signed digest as described in (2).
> +   correctly signed digest as described in (2). Note that verification
> +   happens as long as the file's signature exists regardless the state of
> +   "fs.verity.require_signatures".
>  
>  The data that the signature as described in (2) must be a signature of
>  is the fs-verity file digest in the following format::

Doesn't anything else in this file need to be updated to document the IPE
support?

> diff --git a/fs/verity/open.c b/fs/verity/open.c
> index 6c31a871b84b..f917023255c8 100644
> --- a/fs/verity/open.c
> +++ b/fs/verity/open.c
> @@ -8,6 +8,7 @@
>  #include "fsverity_private.h"
>  
>  #include <linux/mm.h>
> +#include <linux/security.h>
>  #include <linux/slab.h>
>  
>  static struct kmem_cache *fsverity_info_cachep;
> @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg,
>  	return err;
>  }
>  
> +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
> +static int fsverity_inode_setsecurity(struct inode *inode,
> +				      const struct fsverity_descriptor *desc)
> +{
> +	return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME,
> +					  desc->signature,
> +					  le32_to_cpu(desc->sig_size), 0);

Please call it something like FS_VERITY_INODE_BUILTIN_SIG to make it clear that
it's the builtin signature.

> +}
> +#else
> +static inline int fsverity_inode_setsecurity(struct inode *inode,
> +					     const struct fsverity_descriptor *desc)
> +{
> +	return 0;
> +}
> +#endif /* CONFIG_IPE_PROP_FS_VERITY*/

The above comment mentions CONFIG_IPE_PROP_FS_VERITY, but it doesn't appear
anywhere else in the patch.

> +struct fsverity_info *fsverity_create_info(struct inode *inode,
>  					   struct fsverity_descriptor *desc)
>  {
>  	struct fsverity_info *vi;
> @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode,
>  		spin_lock_init(&vi->hash_page_init_lock);
>  	}
>  
> +	err = fsverity_inode_setsecurity(inode, desc);
> +	if (err == -EOPNOTSUPP)
> +		err = 0;

What is the "err == -EOPNOTSUPP" case intended to handle?

> diff --git a/fs/verity/signature.c b/fs/verity/signature.c
> index 90c07573dd77..42f58f4e45d0 100644
> --- a/fs/verity/signature.c
> +++ b/fs/verity/signature.c
> @@ -41,7 +41,9 @@ static struct key *fsverity_keyring;
>   * @sig_size: size of signature in bytes, or 0 if no signature
>   *
>   * If the file includes a signature of its fs-verity file digest, verify it
> - * against the certificates in the fs-verity keyring.
> + * against the certificates in the fs-verity keyring. Note that verification
> + * happens as long as the file's signature exists regardless the state of
> + * fsverity_require_signatures.

Can you please make this mention explicitly that the LSM hook is relying on that
behavior?

- Eric

Eric Biggers March 12, 2024, 3:07 a.m. UTC | #2

On Mon, Mar 11, 2024 at 07:57:12PM -0700, Eric Biggers wrote:
> 
> As I've said before, this commit message needs some work.  It currently doesn't
> say anything about what the patch actually does.
> 
> BTW, please make sure you're Cc'ing the fsverity mailing list
> ([e-mail]), not fscrypt ([e-mail]).

Also, I thought this patch was using a new LSM hook, but I now see that you're
actually abusing the existing security_inode_setsecurity() LSM hook.  Currently
that hook is called when an xattr is set.  I don't see any precedent for
overloading it for other purposes.  This seems problematic, as it means that a
request to set an xattr with the name you chose ("fsverity.builtin-sig") will be
interpreted by LSMs as the fsverity builtin signature.  A dedicated LSM hook may
be necessary to avoid issues with overloading the existing xattr hook like this.

- Eric

Paul Moore March 12, 2024, 1:12 p.m. UTC | #3

On Mon, Mar 11, 2024 at 11:07 PM Eric Biggers <[e-mail]> wrote:
> On Mon, Mar 11, 2024 at 07:57:12PM -0700, Eric Biggers wrote:
> >
> > As I've said before, this commit message needs some work.  It currently doesn't
> > say anything about what the patch actually does.
> >
> > BTW, please make sure you're Cc'ing the fsverity mailing list
> > ([e-mail]), not fscrypt ([e-mail]).
>
> Also, I thought this patch was using a new LSM hook, but I now see that you're
> actually abusing the existing security_inode_setsecurity() LSM hook.  Currently
> that hook is called when an xattr is set.  I don't see any precedent for
> overloading it for other purposes.

I'm not really bothered by this, and if it proves to be a problem in
the future we can swap it for a new hook; we don't include the LSM
in-kernel API in any stable API guarantees.

> This seems problematic, as it means that a
> request to set an xattr with the name you chose ("fsverity.builtin-sig") will be
> interpreted by LSMs as the fsverity builtin signature.  A dedicated LSM hook may
> be necessary to avoid issues with overloading the existing xattr hook like this.

Would you be more comfortable if the name was in an IPE related space,
for example something like "ipe.fsverity-sig"?

Fan Wu March 12, 2024, 6:14 p.m. UTC | #4

On 3/11/2024 8:07 PM, Eric Biggers wrote:
> On Mon, Mar 11, 2024 at 07:57:12PM -0700, Eric Biggers wrote:
>>
>> As I've said before, this commit message needs some work.  It currently doesn't
>> say anything about what the patch actually does.
>>
>> BTW, please make sure you're Cc'ing the fsverity mailing list
>> ([e-mail]), not fscrypt ([e-mail]).
> 
> Also, I thought this patch was using a new LSM hook, but I now see that you're
> actually abusing the existing security_inode_setsecurity() LSM hook.  Currently
> that hook is called when an xattr is set.  I don't see any precedent for
> overloading it for other purposes.  This seems problematic, as it means that a
> request to set an xattr with the name you chose ("fsverity.builtin-sig") will be
> interpreted by LSMs as the fsverity builtin signature.  A dedicated LSM hook may
> be necessary to avoid issues with overloading the existing xattr hook like this.
> 
> - Eric

Thanks for the suggestion. I found that using 
security_inode_setsecurity() causes issues with SMACK's 
inode_setsecurity() hook. I will crate a dedicated new hook like 
security_inode_setsig() in the next version.

-Fan

Fan Wu March 12, 2024, 6:33 p.m. UTC | #5

On 3/11/2024 7:57 PM, Eric Biggers wrote:
> On Wed, Mar 06, 2024 at 03:34:40PM -0800, Fan Wu wrote:
>> fsverity represents a mechanism to support both integrity and
>> authenticity protection of a file, supporting both signed and unsigned
>> digests.
>>
>> An LSM which controls access to a resource based on authenticity and
>> integrity of said resource, can then use this data to make an informed
>> decision on the authorization (provided by the LSM's policy) of said
>> claim.
>>
>> This effectively allows the extension of a policy enforcement layer in
>> LSM for fsverity, allowing for more granular control of how a
>> particular authenticity claim can be used. For example, "all (built-in)
>> signed fsverity files should be allowed to execute, but only these
>> hashes are allowed to be loaded as kernel modules".
>>
>> This enforcement must be done in kernel space, as a userspace only
>> solution would fail a simple litmus test: Download a self-contained
>> malicious binary that never touches the userspace stack. This
>> binary would still be able to execute.
>>
>> Signed-off-by: Deven Bowers <[e-mail]>
>> Signed-off-by: Fan Wu <[e-mail]>
> 
> As I've said before, this commit message needs some work.  It currently doesn't
> say anything about what the patch actually does.
Apologies, I must have missed your previous comment. I appreciate your 
feedback and will ensure that the commit message clearly describes what 
the patch does in the next version. Thank you for pointing this out.

> 
> BTW, please make sure you're Cc'ing the fsverity mailing list
> ([e-mail]), not fscrypt ([e-mail]).
Thanks for the info.

> 
>> diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
>> index 13e4b18e5dbb..64618a6141ab 100644
>> --- a/Documentation/filesystems/fsverity.rst
>> +++ b/Documentation/filesystems/fsverity.rst
>> @@ -461,7 +461,9 @@ Enabling this option adds the following:
>>   
>>   3. A new sysctl "fs.verity.require_signatures" is made available.
>>      When set to 1, the kernel requires that all verity files have a
>> -   correctly signed digest as described in (2).
>> +   correctly signed digest as described in (2). Note that verification
>> +   happens as long as the file's signature exists regardless the state of
>> +   "fs.verity.require_signatures".
>>   
>>   The data that the signature as described in (2) must be a signature of
>>   is the fs-verity file digest in the following format::
> 
> Doesn't anything else in this file need to be updated to document the IPE
> support?
> 
Yes, I can add more details of IPE support in the built-in signature 
section.

>> diff --git a/fs/verity/open.c b/fs/verity/open.c
>> index 6c31a871b84b..f917023255c8 100644
>> --- a/fs/verity/open.c
>> +++ b/fs/verity/open.c
>> @@ -8,6 +8,7 @@
>>   #include "fsverity_private.h"
>>   
>>   #include <linux/mm.h>
>> +#include <linux/security.h>
>>   #include <linux/slab.h>
>>   
>>   static struct kmem_cache *fsverity_info_cachep;
>> @@ -172,12 +173,28 @@ static int compute_file_digest(const struct fsverity_hash_alg *hash_alg,
>>   	return err;
>>   }
>>   
>> +#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
>> +static int fsverity_inode_setsecurity(struct inode *inode,
>> +				      const struct fsverity_descriptor *desc)
>> +{
>> +	return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME,
>> +					  desc->signature,
>> +					  le32_to_cpu(desc->sig_size), 0);
> 
> Please call it something like FS_VERITY_INODE_BUILTIN_SIG to make it clear that
> it's the builtin signature.
>
Thanks for the suggestion, I will take the name.

>> +}
>> +#else
>> +static inline int fsverity_inode_setsecurity(struct inode *inode,
>> +					     const struct fsverity_descriptor *desc)
>> +{
>> +	return 0;
>> +}
>> +#endif /* CONFIG_IPE_PROP_FS_VERITY*/
> 
> The above comment mentions CONFIG_IPE_PROP_FS_VERITY, but it doesn't appear
> anywhere else in the patch.
>
The CONFIG_IPE_PROP_FS_VERITY KCONFIG switch is introduced in a 
subsequent patch. Merging these two patches might not be the best 
approach. I can switch to using CONFIG_FS_VERITY_BUILTIN_SIGNATURES 
instead, which may be more appropriate for the current context.

>> +struct fsverity_info *fsverity_create_info(struct inode *inode,
>>   					   struct fsverity_descriptor *desc)
>>   {
>>   	struct fsverity_info *vi;
>> @@ -242,6 +259,13 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode,
>>   		spin_lock_init(&vi->hash_page_init_lock);
>>   	}
>>   
>> +	err = fsverity_inode_setsecurity(inode, desc);
>> +	if (err == -EOPNOTSUPP)
>> +		err = 0;
> 
> What is the "err == -EOPNOTSUPP" case intended to handle?
>
The -EOPNOTSUPP is designed to signal situations where the called LSM 
hook does not support associating the passed name with a value, but the 
hook call itself does not encounter any errors. Also, -EOPNOTSUPP is the 
default return value of security_inode_setsecurity when no LSM has 
registered the hook. In summary, it indicates that no hook call 
succeeded, but no critical error occurred.

>> diff --git a/fs/verity/signature.c b/fs/verity/signature.c
>> index 90c07573dd77..42f58f4e45d0 100644
>> --- a/fs/verity/signature.c
>> +++ b/fs/verity/signature.c
>> @@ -41,7 +41,9 @@ static struct key *fsverity_keyring;
>>    * @sig_size: size of signature in bytes, or 0 if no signature
>>    *
>>    * If the file includes a signature of its fs-verity file digest, verify it
>> - * against the certificates in the fs-verity keyring.
>> + * against the certificates in the fs-verity keyring. Note that verification
>> + * happens as long as the file's signature exists regardless the state of
>> + * fsverity_require_signatures.
> 
> Can you please make this mention explicitly that the LSM hook is relying on that
> behavior?
Sure, I can add this info.
-Fan
> 
> - Eric

Casey Schaufler March 12, 2024, 6:51 p.m. UTC | #6

On 3/12/2024 11:14 AM, Fan Wu wrote:
>
>
> On 3/11/2024 8:07 PM, Eric Biggers wrote:
>> On Mon, Mar 11, 2024 at 07:57:12PM -0700, Eric Biggers wrote:
>>>
>>> As I've said before, this commit message needs some work.  It
>>> currently doesn't
>>> say anything about what the patch actually does.
>>>
>>> BTW, please make sure you're Cc'ing the fsverity mailing list
>>> ([e-mail]), not fscrypt
>>> ([e-mail]).
>>
>> Also, I thought this patch was using a new LSM hook, but I now see
>> that you're
>> actually abusing the existing security_inode_setsecurity() LSM hook. 
>> Currently
>> that hook is called when an xattr is set.  I don't see any precedent for
>> overloading it for other purposes.  This seems problematic, as it
>> means that a
>> request to set an xattr with the name you chose
>> ("fsverity.builtin-sig") will be
>> interpreted by LSMs as the fsverity builtin signature.  A dedicated
>> LSM hook may
>> be necessary to avoid issues with overloading the existing xattr hook
>> like this.
>>
>> - Eric
>
> Thanks for the suggestion. I found that using
> security_inode_setsecurity() causes issues with SMACK's
> inode_setsecurity() hook. I will crate a dedicated new hook like
> security_inode_setsig() in the next version.

What is the issue you encountered with the Smack hook?

>
> -Fan
>

Fan Wu March 12, 2024, 7:08 p.m. UTC | #7

On 3/12/2024 11:51 AM, Casey Schaufler wrote:
> On 3/12/2024 11:14 AM, Fan Wu wrote:
>>
>>
>> On 3/11/2024 8:07 PM, Eric Biggers wrote:
>>> On Mon, Mar 11, 2024 at 07:57:12PM -0700, Eric Biggers wrote:
>>>>
>>>> As I've said before, this commit message needs some work.  It
>>>> currently doesn't
>>>> say anything about what the patch actually does.
>>>>
>>>> BTW, please make sure you're Cc'ing the fsverity mailing list
>>>> ([e-mail]), not fscrypt
>>>> ([e-mail]).
>>>
>>> Also, I thought this patch was using a new LSM hook, but I now see
>>> that you're
>>> actually abusing the existing security_inode_setsecurity() LSM hook.
>>> Currently
>>> that hook is called when an xattr is set.  I don't see any precedent for
>>> overloading it for other purposes.  This seems problematic, as it
>>> means that a
>>> request to set an xattr with the name you chose
>>> ("fsverity.builtin-sig") will be
>>> interpreted by LSMs as the fsverity builtin signature.  A dedicated
>>> LSM hook may
>>> be necessary to avoid issues with overloading the existing xattr hook
>>> like this.
>>>
>>> - Eric
>>
>> Thanks for the suggestion. I found that using
>> security_inode_setsecurity() causes issues with SMACK's
>> inode_setsecurity() hook. I will crate a dedicated new hook like
>> security_inode_setsig() in the next version.
> 
> What is the issue you encountered with the Smack hook?
> 

The current hook call for saving file signature will fail at 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/security/smack/smack_lsm.c#n2855 
.

The issue is file signature size is larger than SMK_LONGLABEL so if 
SMACK is enabled the SMACK's hook will return -EINVAL, which prevents us 
to use security_inode_setsecurity() to save file signature into security 
blob.

We could also make security_inode_setsecurity() more generic instead of 
for xattr only, any suggestions?

-Fan

Paul Moore March 12, 2024, 8:07 p.m. UTC | #8

On Tue, Mar 12, 2024 at 3:08 PM Fan Wu <[e-mail]> wrote:
> We could also make security_inode_setsecurity() more generic instead of
> for xattr only, any suggestions?

For the sake of simplicity, since security_inode_setsecurity() doesn't
work, it probably makes more sense to create a new LSM hook rather
than make significant changes to security_inode_setsecurity().

I'm looking at the fsverity hook usage in this patch as well as the
device-mapper hook usage in 13/19 with security_bdev_setsecurity() and
I'm wondering if we could adopt a similar hook as we do with block
devices:

/* NOTE: these are just example values, more granularity would likely
be needed */
enum {
  LSM_INTGR_DIGEST,
  LSM_INTGR_SIG,
} lsm_intgr_type;

/**
 * security_inode_integrity() - Set the inode's integrity data
 * @inode: the inode
 * @integrity_type: type of integrity, e.g. hash digest, signature, etc.
 * @value: the integrity value
 * @value: size of the integrity value
 *
 * Register a verified integrity measurement of an inode with the LSM.
 *
 * Return: Returns 0 on success, negative values on failure.
 */
int security_inode_integrity(struct inode *inode,
                             enum lsm_intgr_type type,
                             const void *value, size_t size)

... if the above makes sense, I'd probably adjust
security_bdev_setsecurity() both to have a similar name, e.g.
/inode/bdev/, as well as to take a lsm_intgr_type enum instead of the
character string ... unless we really need a character string for some
reason, in which case use a character string in both places.

--
paul-moore.com

Patch

diff --git a/Documentation/filesystems/fsverity.rst b/Documentation/filesystems/fsverity.rst
index 13e4b18e5dbb..64618a6141ab 100644
--- a/Documentation/filesystems/fsverity.rst
+++ b/Documentation/filesystems/fsverity.rst
@@ -461,7 +461,9 @@  Enabling this option adds the following:
 
 3. A new sysctl "fs.verity.require_signatures" is made available.
    When set to 1, the kernel requires that all verity files have a
-   correctly signed digest as described in (2).
+   correctly signed digest as described in (2). Note that verification
+   happens as long as the file's signature exists regardless the state of
+   "fs.verity.require_signatures".
 
 The data that the signature as described in (2) must be a signature of
 is the fs-verity file digest in the following format::
diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h
index a6a6b2749241..84a3608f2f9b 100644
--- a/fs/verity/fsverity_private.h
+++ b/fs/verity/fsverity_private.h
@@ -118,7 +118,7 @@  int fsverity_init_merkle_tree_params(struct merkle_tree_params *params,
 				     unsigned int log_blocksize,
 				     const u8 *salt, size_t salt_size);
 
-struct fsverity_info *fsverity_create_info(const struct inode *inode,
+struct fsverity_info *fsverity_create_info(struct inode *inode,
 					   struct fsverity_descriptor *desc);
 
 void fsverity_set_info(struct inode *inode, struct fsverity_info *vi);
diff --git a/fs/verity/open.c b/fs/verity/open.c
index 6c31a871b84b..f917023255c8 100644
--- a/fs/verity/open.c
+++ b/fs/verity/open.c
@@ -8,6 +8,7 @@ 
 #include "fsverity_private.h"
 
 #include <linux/mm.h>
+#include <linux/security.h>
 #include <linux/slab.h>
 
 static struct kmem_cache *fsverity_info_cachep;
@@ -172,12 +173,28 @@  static int compute_file_digest(const struct fsverity_hash_alg *hash_alg,
 	return err;
 }
 
+#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES
+static int fsverity_inode_setsecurity(struct inode *inode,
+				      const struct fsverity_descriptor *desc)
+{
+	return security_inode_setsecurity(inode, FS_VERITY_INODE_SEC_NAME,
+					  desc->signature,
+					  le32_to_cpu(desc->sig_size), 0);
+}
+#else
+static inline int fsverity_inode_setsecurity(struct inode *inode,
+					     const struct fsverity_descriptor *desc)
+{
+	return 0;
+}
+#endif /* CONFIG_IPE_PROP_FS_VERITY*/
+
 /*
  * Create a new fsverity_info from the given fsverity_descriptor (with optional
  * appended builtin signature), and check the signature if present.  The
  * fsverity_descriptor must have already undergone basic validation.
  */
-struct fsverity_info *fsverity_create_info(const struct inode *inode,
+struct fsverity_info *fsverity_create_info(struct inode *inode,
 					   struct fsverity_descriptor *desc)
 {
 	struct fsverity_info *vi;
@@ -242,6 +259,13 @@  struct fsverity_info *fsverity_create_info(const struct inode *inode,
 		spin_lock_init(&vi->hash_page_init_lock);
 	}
 
+	err = fsverity_inode_setsecurity(inode, desc);
+	if (err == -EOPNOTSUPP)
+		err = 0;
+
+	if (err)
+		goto fail;
+
 	return vi;
 
 fail:
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 90c07573dd77..42f58f4e45d0 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c
@@ -41,7 +41,9 @@  static struct key *fsverity_keyring;
  * @sig_size: size of signature in bytes, or 0 if no signature
  *
  * If the file includes a signature of its fs-verity file digest, verify it
- * against the certificates in the fs-verity keyring.
+ * against the certificates in the fs-verity keyring. Note that verification
+ * happens as long as the file's signature exists regardless the state of
+ * fsverity_require_signatures.
  *
  * Return: 0 on success (signature valid or not required); -errno on failure
  */
diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h
index 1eb7eae580be..9666721baf15 100644
--- a/include/linux/fsverity.h
+++ b/include/linux/fsverity.h
@@ -319,4 +319,6 @@  static inline int fsverity_prepare_setattr(struct dentry *dentry,
 	return 0;
 }
 
+#define FS_VERITY_INODE_SEC_NAME "fsverity.builtin-sig"
+
 #endif	/* _LINUX_FSVERITY_H */