From 4314bb0b2b96cc3a84e8dead29812ccb1bfcebe2 Mon Sep 17 00:00:00 2001
From: gVisor bot <gvisor-bot@google.com>
Date: Thu, 11 Feb 2021 17:09:49 -0800
Subject: Internal change.

PiperOrigin-RevId: 357090170
---
 pkg/sentry/vfs/vfs.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'pkg/sentry/vfs')

diff --git a/pkg/sentry/vfs/vfs.go b/pkg/sentry/vfs/vfs.go
index 0aff2dd92..b0e13cdab 100644
--- a/pkg/sentry/vfs/vfs.go
+++ b/pkg/sentry/vfs/vfs.go
@@ -425,7 +425,9 @@ func (vfs *VirtualFilesystem) OpenAt(ctx context.Context, creds *auth.Credential
 		rp.mustBeDir = true
 		rp.mustBeDirOrig = true
 	}
-	if opts.Flags&linux.O_PATH != 0 {
+	// Ignore O_PATH for verity, as verity performs extra operations on the fd for verification.
+	// The underlying filesystem that verity wraps opens the fd with O_PATH.
+	if opts.Flags&linux.O_PATH != 0 && rp.mount.fs.FilesystemType().Name() != "verity" {
 		vd, err := vfs.GetDentryAt(ctx, creds, pop, &GetDentryOptions{})
 		if err != nil {
 			return nil, err
-- 
cgit v1.2.3