Module fsverity 

Linux fs-verity support for integrity verification.

This module provides complete fs-verity functionality including userspace digest computation, kernel ioctl interfaces for enabling and measuring verity, and hash value types for SHA-256 and SHA-512.

Structs

FsVerityHasher

Incremental fs-verity digest computation.

Sha256HashValue

A SHA-256 hash value for fs-verity operations.

Sha512HashValue

A SHA-512 hash value for fs-verity operations.

Enums

Algorithm

An fs-verity algorithm identifier.

AlgorithmParseError

Errors from parsing an Algorithm string.

CompareVerityError

A verity comparison failed.

EnableVerityError

Enabling fsverity failed.

MeasureVerityError

Measuring fsverity failed.

Constants

DEFAULT_LG_BLOCKSIZE

Default log2 block size for fs-verity (4096 bytes).

Traits

FsVerityHashValue

Trait for fs-verity hash value types supporting SHA-256 and SHA-512.

Functions

compute_verity

Compute the fs-verity digest for a given block of data, in userspace.

enable_verity_maybe_copy

Enable fs-verity on the given file. If the given file cannot be enabled because it is opened as writable, then a new copy of the file will be returned instead. No attempt is made to sync the copied file contents to disk, it is up to the caller to do so if desired.

enable_verity_raw

Enable fs-verity on the given file.

enable_verity_with_retry

Enable fs-verity on the given file, retrying if file is opened for writing.

ensure_verity_equal

Compare the fs-verity digest of the file versus the expected digest.

measure_verity

Measures fs-verity on the given file.

measure_verity_opt

Measures fs-verity on the given file.

measure_verity_with_fallback

Try FS_IOC_MEASURE_VERITY; fall back to in-process Merkle-tree computation when the kernel reports that verity is absent or the filesystem doesn’t support it. This mirrors lcfs_fd_get_fsverity() in the C composefs library.