3 files changed, 22 insertions, 0 deletions
diff --git a/pkg/abi/linux/ioctl.go b/pkg/abi/linux/ioctl.go
index a4fe7501d..3356a2b4a 100644
--- a/pkg/abi/linux/ioctl.go
+++ b/pkg/abi/linux/ioctl.go
@@ -113,6 +113,12 @@ const (
 	_IOC_DIRSHIFT  = _IOC_SIZESHIFT + _IOC_SIZEBITS
 )
 
+// Constants from uapi/linux/fs.h.
+const (
+	FS_IOC_GETFLAGS = 2147771905
+	FS_VERITY_FL    = 1048576
+)
+
 // Constants from uapi/linux/fsverity.h.
 const (
 	FS_IOC_ENABLE_VERITY = 1082156677
diff --git a/pkg/sentry/fsimpl/verity/BUILD b/pkg/sentry/fsimpl/verity/BUILD
index d28450e53..814eb2085 100644
--- a/pkg/sentry/fsimpl/verity/BUILD
+++ b/pkg/sentry/fsimpl/verity/BUILD
@@ -16,6 +16,7 @@ go_library(
         "//pkg/merkletree",
         "//pkg/sentry/arch",
         "//pkg/sentry/fs/lock",
+        "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/socket/unix/transport",
         "//pkg/sentry/vfs",
diff --git a/pkg/sentry/fsimpl/verity/verity.go b/pkg/sentry/fsimpl/verity/verity.go
index 0bac8e938..e352ce197 100644
--- a/pkg/sentry/fsimpl/verity/verity.go
+++ b/pkg/sentry/fsimpl/verity/verity.go
@@ -32,6 +32,7 @@ import (
 	"gvisor.dev/gvisor/pkg/merkletree"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	fslock "gvisor.dev/gvisor/pkg/sentry/fs/lock"
+	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
@@ -589,11 +590,25 @@ func (fd *fileDescription) enableVerity(ctx context.Context, uio usermem.IO, arg
 	return 0, nil
 }
 
+func (fd *fileDescription) getFlags(ctx context.Context, uio usermem.IO, args arch.SyscallArguments) (uintptr, error) {
+	f := int32(0)
+
+	// All enabled files should store a root hash. This flag is not settable
+	// via FS_IOC_SETFLAGS.
+	if len(fd.d.rootHash) != 0 {
+		f |= linux.FS_VERITY_FL
+	}
+	_, err := kernel.TaskFromContext(ctx).CopyOut(args[2].Pointer(), f)
+	return 0, err
+}
+
 // Ioctl implements vfs.FileDescriptionImpl.Ioctl.
 func (fd *fileDescription) Ioctl(ctx context.Context, uio usermem.IO, args arch.SyscallArguments) (uintptr, error) {
 	switch cmd := args[1].Uint(); cmd {
 	case linux.FS_IOC_ENABLE_VERITY:
 		return fd.enableVerity(ctx, uio, args)
+	case linux.FS_IOC_GETFLAGS:
+		return fd.getFlags(ctx, uio, args)
 	default:
 		return fd.lowerFD.Ioctl(ctx, uio, args)
 	}