dm-verity: clear LSM integrity state on suspend

dm-verity publishes its root hash and signature state to LSMs in
verity_preresume(). LSMs such as IPE store this information in the block
device's security blob and use it to authorize access to files.

The original LSM integration relied on DM_TARGET_IMMUTABLE to prevent
verity from being replaced by a different target type. However, DM allows
tables containing a DM_TARGET_WILDCARD target to replace immutable
targets. The block device can then retain the old integrity state even
though its data is no longer verified by dm-verity.

Clear the published root hash and signature state in verity_postsuspend()
so that the block device does not retain stale dm-verity attributes after
the verity target is replaced.

Assisted-by: gpt-6-astra
Signed-off-by: Fan Wu <wufan@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

0 files changed, 0 insertions, 0 deletions