From nobody Fri Dec 19 10:56:09 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82E944B155; Tue, 19 Dec 2023 17:52:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="aCQm9B6w" Received: from pps.filterd (m0353728.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJHgJ6B006624; Tue, 19 Dec 2023 17:52:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=ucpCVXeS9j5rwPkRYgV2mtvILK/eCTItebGDK+ov8mw=; b=aCQm9B6wbJ8jo90hQMLH9DugmN61ZSYL6PBfx30voqzfCHFX7RsUsxul1bi/JRhtvwuN BgjHp16QyH4/V59uqdd2t+UnuvudliK43sWB0nruSvE1yixxcpzUe8PxpSIwZSZ2tiHA a2BeAeVQ62VsKODdzO/DRSHhj+iN+bol58rnul4WN3a3ZzyommOSBAIrZUYxmskOHOIR 93Gph93pHXhYu5rQ/7g37rdUyorgRIcLhXEcSOmUP2fo1kd3tOfCg1lg/vSdfOz3vYvK X0DZ5fBRqBxyFWlfLdj21CzOB78JWq3mXJDEHsR5+uLC9TQPuJX8W8ooJd1l5bGwr8hK vA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3fk5rkmk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:18 +0000 Received: from m0353728.ppops.net (m0353728.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3BJHUZle031471; Tue, 19 Dec 2023 17:52:18 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3fk5rkm8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:18 +0000 Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJHP3EG029718; Tue, 19 Dec 2023 17:52:17 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 3v1p7shpkx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:17 +0000 Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3BJHqFma22020672 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 19 Dec 2023 17:52:15 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAC6220040; Tue, 19 Dec 2023 17:52:15 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AD8DB20043; Tue, 19 Dec 2023 17:52:13 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.61.138.145]) by smtpav01.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 19 Dec 2023 17:52:13 +0000 (GMT) From: Mimi Zohar To: linux-unionfs@vger.kernel.org Cc: Mimi Zohar , linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Amir Goldstein , Christian Brauner , Seth Forshee , Roberto Sassu Subject: [PATCH v2 1/3] evm: don't copy up 'security.evm' xattr Date: Tue, 19 Dec 2023 12:52:04 -0500 Message-Id: <20231219175206.12342-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231219175206.12342-1-zohar@linux.ibm.com> References: <20231219175206.12342-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: I5Ord6MBRPRcteUILlS7eHIK2uIXf0gY X-Proofpoint-ORIG-GUID: N5OIpIMqvV6z9XtZBmbZBPn_wCbmAHwa X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-19_10,2023-12-14_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 malwarescore=0 phishscore=0 mlxlogscore=696 spamscore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312190133 Content-Type: text/plain; charset="utf-8" The security.evm HMAC and the original file signatures contain filesystem specific data. As a result, the HMAC and signature are not the same on the stacked and backing filesystems. Don't copy up 'security.evm'. Reviewed-by: Amir Goldstein Signed-off-by: Mimi Zohar Reviewed-by: Christian Brauner --- include/linux/evm.h | 6 ++++++ security/integrity/evm/evm_main.c | 7 +++++++ security/security.c | 2 +- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/include/linux/evm.h b/include/linux/evm.h index 01fc495a83e2..36ec884320d9 100644 --- a/include/linux/evm.h +++ b/include/linux/evm.h @@ -31,6 +31,7 @@ extern void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, const void *xattr_value, size_t xattr_value_len); +extern int evm_inode_copy_up_xattr(const char *name); extern int evm_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *xattr_name); extern void evm_inode_post_removexattr(struct dentry *dentry, @@ -117,6 +118,11 @@ static inline void evm_inode_post_setxattr(struct dent= ry *dentry, return; } =20 +static inline int evm_inode_copy_up_xattr(const char *name) +{ + return 0; +} + static inline int evm_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *xattr_name) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm= _main.c index 894570fe39bc..02adba635b02 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -863,6 +863,13 @@ void evm_inode_post_setattr(struct dentry *dentry, int= ia_valid) evm_update_evmxattr(dentry, NULL, NULL, 0); } =20 +int evm_inode_copy_up_xattr(const char *name) +{ + if (strcmp(name, XATTR_NAME_EVM) =3D=3D 0) + return 1; /* Discard */ + return -EOPNOTSUPP; +} + /* * evm_inode_init_security - initializes security.evm HMAC value */ diff --git a/security/security.c b/security/security.c index dcb3e7014f9b..f00ec4d988b8 100644 --- a/security/security.c +++ b/security/security.c @@ -2539,7 +2539,7 @@ int security_inode_copy_up_xattr(const char *name) return rc; } =20 - return LSM_RET_DEFAULT(inode_copy_up_xattr); + return evm_inode_copy_up_xattr(name); } EXPORT_SYMBOL(security_inode_copy_up_xattr); =20 --=20 2.39.3 From nobody Fri Dec 19 10:56:09 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8158D4B15A; Tue, 19 Dec 2023 17:52:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MCoWO2iw" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJGuba1031658; Tue, 19 Dec 2023 17:52:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=ubw/02NX+oGg4rMZa0xxhA5je29gZEt2sBM9XgRMLAE=; b=MCoWO2iw4rWGNOmjpYa6CeLIGQyM2EOO1a9ujnGTEkp/kS9YRgWV4ObJDPt9vDVFhrwJ UegTLZ68Jkj/+gSsVdhIkWacP1MaQ8GVyllHuBgLlCNWe/VrSt2EWpZUENeEun0m4S94 eu/EaC0Q7m4chH+iiHBytGAMwwm0lImAuBek4wTGwwd1YnhI416xLCIaphdvK6Wmz5J1 Kntem0cx188GHWiol/RH51zQo2HKPjmjPp2Am2H6OHz/BqHzeldLMAbcmVShX6ursDll DSrG895goJHtHCXtk6sYskB4GeCB0dxNhZVl0WKrvnHy5NTvfK5b7GX/t6PYRVpUOuls LA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3d5u5170-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:21 +0000 Received: from m0353729.ppops.net (m0353729.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3BJGvGt1002295; Tue, 19 Dec 2023 17:52:20 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3d5u516f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:20 +0000 Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJGVnNq027074; Tue, 19 Dec 2023 17:52:19 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 3v1rek14a1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:19 +0000 Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3BJHqHBH6029852 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 19 Dec 2023 17:52:18 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D4C6820043; Tue, 19 Dec 2023 17:52:17 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 19FD420040; Tue, 19 Dec 2023 17:52:16 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.61.138.145]) by smtpav01.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 19 Dec 2023 17:52:15 +0000 (GMT) From: Mimi Zohar To: linux-unionfs@vger.kernel.org Cc: Mimi Zohar , linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Amir Goldstein , Christian Brauner , Seth Forshee , Roberto Sassu Subject: [PATCH v2 2/3] evm: add support to disable EVM on unsupported filesystems Date: Tue, 19 Dec 2023 12:52:05 -0500 Message-Id: <20231219175206.12342-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231219175206.12342-1-zohar@linux.ibm.com> References: <20231219175206.12342-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: sw4cRC9kcEPU8sCeqQ4m2TkoPQ9ytdvT X-Proofpoint-ORIG-GUID: TUMf6bEFbJlZGUVSGAbqDczSow3KzQnq X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-19_10,2023-12-14_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 spamscore=0 phishscore=0 mlxlogscore=755 clxscore=1015 impostorscore=0 bulkscore=0 malwarescore=0 priorityscore=1501 mlxscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312190133 Content-Type: text/plain; charset="utf-8" Identify EVM unsupported filesystems by defining a new flag SB_I_EVM_UNSUPPORTED. Don't verify, write, remove or update 'security.evm' on unsupported filesystems. Signed-off-by: Mimi Zohar Acked-by: Amir Goldstein Reviewed-by: Christian Brauner --- include/linux/fs.h | 1 + security/integrity/evm/evm_main.c | 35 ++++++++++++++++++++++++++++++- 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/include/linux/fs.h b/include/linux/fs.h index 98b7a7a8c42e..db9350a734ef 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1164,6 +1164,7 @@ extern int send_sigurg(struct fown_struct *fown); #define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ #define SB_I_IMA_UNVERIFIABLE_SIGNATURE 0x00000020 #define SB_I_UNTRUSTED_MOUNTER 0x00000040 +#define SB_I_EVM_UNSUPPORTED 0x00000050 =20 #define SB_I_SKIP_SYNC 0x00000100 /* Skip superblock at global sync */ #define SB_I_PERSB_BDI 0x00000200 /* has a per-sb bdi */ diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm= _main.c index 02adba635b02..cc7956d7878b 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -151,6 +151,17 @@ static int evm_find_protected_xattrs(struct dentry *de= ntry) return count; } =20 +static int is_unsupported_fs(struct dentry *dentry) +{ + struct inode *inode =3D d_backing_inode(dentry); + + if (inode->i_sb->s_iflags & SB_I_EVM_UNSUPPORTED) { + pr_info_once("%s not supported\n", inode->i_sb->s_type->name); + return 1; + } + return 0; +} + /* * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr * @@ -181,6 +192,9 @@ static enum integrity_status evm_verify_hmac(struct den= try *dentry, iint->evm_status =3D=3D INTEGRITY_PASS_IMMUTABLE)) return iint->evm_status; =20 + if (is_unsupported_fs(dentry)) + return INTEGRITY_UNKNOWN; + /* if status is not PASS, try to check again - against -ENOMEM */ =20 /* first need to know the sig type */ @@ -408,6 +422,9 @@ enum integrity_status evm_verifyxattr(struct dentry *de= ntry, if (!evm_key_loaded() || !evm_protected_xattr(xattr_name)) return INTEGRITY_UNKNOWN; =20 + if (is_unsupported_fs(dentry)) + return INTEGRITY_UNKNOWN; + if (!iint) { iint =3D integrity_iint_find(d_backing_inode(dentry)); if (!iint) @@ -491,15 +508,21 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, if (strcmp(xattr_name, XATTR_NAME_EVM) =3D=3D 0) { if (!capable(CAP_SYS_ADMIN)) return -EPERM; + if (is_unsupported_fs(dentry)) + return -EPERM; } else if (!evm_protected_xattr(xattr_name)) { if (!posix_xattr_acl(xattr_name)) return 0; + if (is_unsupported_fs(dentry)) + return 0; + evm_status =3D evm_verify_current_integrity(dentry); if ((evm_status =3D=3D INTEGRITY_PASS) || (evm_status =3D=3D INTEGRITY_NOXATTRS)) return 0; goto out; - } + } else if (is_unsupported_fs(dentry)) + return 0; =20 evm_status =3D evm_verify_current_integrity(dentry); if (evm_status =3D=3D INTEGRITY_NOXATTRS) { @@ -750,6 +773,9 @@ void evm_inode_post_setxattr(struct dentry *dentry, con= st char *xattr_name, if (!(evm_initialized & EVM_INIT_HMAC)) return; =20 + if (is_unsupported_fs(dentry)) + return; + evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); } =20 @@ -814,8 +840,12 @@ int evm_inode_setattr(struct mnt_idmap *idmap, struct = dentry *dentry, if (evm_initialized & EVM_ALLOW_METADATA_WRITES) return 0; =20 + if (is_unsupported_fs(dentry)) + return 0; + if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))) return 0; + evm_status =3D evm_verify_current_integrity(dentry); /* * Writing attrs is safe for portable signatures, as portable signatures @@ -859,6 +889,9 @@ void evm_inode_post_setattr(struct dentry *dentry, int = ia_valid) if (!(evm_initialized & EVM_INIT_HMAC)) return; =20 + if (is_unsupported_fs(dentry)) + return; + if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) evm_update_evmxattr(dentry, NULL, NULL, 0); } --=20 2.39.3 From nobody Fri Dec 19 10:56:09 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83D2D4B5A1; Tue, 19 Dec 2023 17:52:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="PhC7AOMb" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJGucNb031777; Tue, 19 Dec 2023 17:52:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Ate2nQXbafi7WMu36jIrSAMLBThAwZVJ7XxcLPp9YLg=; b=PhC7AOMbFo0UFXB0jgULWba/ju+jRIfjUwTvmZAGm5tLFOQjIMdOo7zZxhi/P75p7x8y ai4wQUd57AJpUuTobyBoatPKN9Pw716pcNOCBareM5gFEIQn2iJtbqCFpgZ7tyac+st/ d2ae+ZcBPmN4NAtiCpaGXuX6yqatMzQ/9E6RyzAWDv7jJG+PGUAARJEdAhFmS1l0ri82 cKwV7SzmyeUOq50eU5lFzMTPu9tFh77hnVyIzkE4bFGESF7950oV90fVtl4u1N3MCfCJ OoURWtW17r3cPH5Gof0fUCbEv7wk3FSiDnpUW8T4LTvIEs5TBCy36VLKth9djbwkSKYg bw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3d5u5185-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:23 +0000 Received: from m0353729.ppops.net (m0353729.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3BJGuggB032360; Tue, 19 Dec 2023 17:52:23 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3d5u517r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:23 +0000 Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJFm1bD010900; Tue, 19 Dec 2023 17:52:22 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3v1q7nheg1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 17:52:21 +0000 Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3BJHqJ1n15991452 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 19 Dec 2023 17:52:20 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DAA1D2004B; Tue, 19 Dec 2023 17:52:19 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2EDE320043; Tue, 19 Dec 2023 17:52:18 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.61.138.145]) by smtpav01.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 19 Dec 2023 17:52:17 +0000 (GMT) From: Mimi Zohar To: linux-unionfs@vger.kernel.org Cc: Mimi Zohar , linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Amir Goldstein , Christian Brauner , Seth Forshee , Roberto Sassu Subject: [PATCH v2 3/3] overlay: disable EVM Date: Tue, 19 Dec 2023 12:52:06 -0500 Message-Id: <20231219175206.12342-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231219175206.12342-1-zohar@linux.ibm.com> References: <20231219175206.12342-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: l6owamPJ2tsk1ibyGUYFdROvgtzvvV6p X-Proofpoint-ORIG-GUID: aFUWRoiknWYYO-D-vDItShJhEj4KhB1X X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-19_10,2023-12-14_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 spamscore=0 phishscore=0 mlxlogscore=631 clxscore=1015 impostorscore=0 bulkscore=0 malwarescore=0 priorityscore=1501 mlxscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312190133 Content-Type: text/plain; charset="utf-8" Until a complete solution is developed, update 'sb->s_iflags' to disable EVM. Signed-off-by: Mimi Zohar Acked-by: Amir Goldstein Reviewed-by: Christian Brauner --- fs/overlayfs/super.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index a0967bb25003..e3d9c6c80a47 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -1454,6 +1454,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_= context *fc) * lead to unexpected results. */ sb->s_iflags |=3D SB_I_NOUMASK; + sb->s_iflags |=3D SB_I_EVM_UNSUPPORTED; =20 err =3D -ENOMEM; root_dentry =3D ovl_get_root(sb, ctx->upper.dentry, oe); --=20 2.39.3