1 files changed, 45 insertions, 0 deletions
diff --git a/pkg/sentry/fsimpl/verity/verity.go b/pkg/sentry/fsimpl/verity/verity.go
index 374f71568..ec64015cd 100644
--- a/pkg/sentry/fsimpl/verity/verity.go
+++ b/pkg/sentry/fsimpl/verity/verity.go
@@ -38,6 +38,7 @@ import (
 	"fmt"
 	"math"
 	"strconv"
+	"strings"
 	"sync/atomic"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -750,6 +751,50 @@ func (fd *fileDescription) SetStat(ctx context.Context, opts vfs.SetStatOptions)
 	return syserror.EPERM
 }
 
+// IterDirents implements vfs.FileDescriptionImpl.IterDirents.
+func (fd *fileDescription) IterDirents(ctx context.Context, cb vfs.IterDirentsCallback) error {
+	if !fd.d.isDir() {
+		return syserror.ENOTDIR
+	}
+	fd.mu.Lock()
+	defer fd.mu.Unlock()
+
+	var ds []vfs.Dirent
+	err := fd.lowerFD.IterDirents(ctx, vfs.IterDirentsCallbackFunc(func(dirent vfs.Dirent) error {
+		// Do not include the Merkle tree files.
+		if strings.Contains(dirent.Name, merklePrefix) || strings.Contains(dirent.Name, merkleRootPrefix) {
+			return nil
+		}
+		if fd.d.verityEnabled() {
+			// Verify that the child is expected.
+			if dirent.Name != "." && dirent.Name != ".." {
+				if _, ok := fd.d.childrenNames[dirent.Name]; !ok {
+					return alertIntegrityViolation(fmt.Sprintf("Unexpected children %s", dirent.Name))
+				}
+			}
+		}
+		ds = append(ds, dirent)
+		return nil
+	}))
+
+	if err != nil {
+		return err
+	}
+
+	// The result should contain all children plus "." and "..".
+	if fd.d.verityEnabled() && len(ds) != len(fd.d.childrenNames)+2 {
+		return alertIntegrityViolation(fmt.Sprintf("Unexpected children number %d", len(ds)))
+	}
+
+	for fd.off < int64(len(ds)) {
+		if err := cb.Handle(ds[fd.off]); err != nil {
+			return err
+		}
+		fd.off++
+	}
+	return nil
+}
+
 // Seek implements vfs.FileDescriptionImpl.Seek.
 func (fd *fileDescription) Seek(ctx context.Context, offset int64, whence int32) (int64, error) {
 	fd.mu.Lock()