From 0903fd268324fda1de615d621975aae27b53aa56 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 8 Sep 2021 17:30:33 +0200 Subject: [PATCH] dissect-image: refuse external verity data in partitioned mode Our code doesn't support setting up verity with an external verity data file unless we operate in non-partitioned mode. Let's refuse this clearly and early if attempted anyway. --- src/shared/dissect-image.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index 4f398316ae..480e4a2284 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -839,6 +839,10 @@ int dissect_image( if (!is_gpt && ((flags & DISSECT_IMAGE_GPT_ONLY) || !is_mbr)) return -ENOPKG; + /* We support external verity data partitions only if the image has no partition table */ + if (verity && verity->data_path) + return -EBADR; + /* Safety check: refuse block devices that carry a partition table but for which the kernel doesn't * do partition scanning. */ r = blockdev_partscan_enabled(fd); -- 2.25.1