Clear Merkle tree files in RuntimeEnable mode

The Merkle tree files need to be cleared before enabling to avoid
redundant content.

PiperOrigin-RevId: 362409591

1 files changed, 17 insertions, 0 deletions

diff --git a/pkg/sentry/fsimpl/verity/filesystem.go b/pkg/sentry/fsimpl/verity/filesystem.go
index 9057d2b4e..6cb1a23e0 100644
--- a/pkg/sentry/fsimpl/verity/filesystem.go
+++ b/pkg/sentry/fsimpl/verity/filesystem.go
@@ -590,6 +590,23 @@ func (fs *filesystem) lookupAndVerifyLocked(ctx context.Context, parent *dentry,
 		return nil, err
 	}
 
+	// Clear the Merkle tree file if they are to be generated at runtime.
+	// TODO(b/182315468): Optimize the Merkle tree generate process to
+	// allow only updating certain files/directories.
+	if fs.allowRuntimeEnable {
+		childMerkleFD, err := vfsObj.OpenAt(ctx, fs.creds, &vfs.PathOperation{
+			Root:  childMerkleVD,
+			Start: childMerkleVD,
+		}, &vfs.OpenOptions{
+			Flags: linux.O_RDWR | linux.O_TRUNC,
+			Mode:  0644,
+		})
+		if err != nil {
+			return nil, err
+		}
+		childMerkleFD.DecRef(ctx)
+	}
+
 	// The dentry needs to be cleaned up if any error occurs. IncRef will be
 	// called if a verity child dentry is successfully created.
 	defer childMerkleVD.DecRef(ctx)