[v1] ima: don't measure/appraise files on configfs

[PATCH 0/2] ima: don't measure/appraise files on configfs

Frederick Lawler posted 2 patches 1 month, 1 week ago

Diff against v2
Download series mbox

There is a newer version of this series

fs/configfs/mount.c                 | 4 +---
include/uapi/linux/magic.h          | 1 +
security/integrity/ima/ima_policy.c | 7 ++++++-
3 files changed, 8 insertions(+), 4 deletions(-)

Expand all Fold all

[PATCH 0/2] ima: don't measure/appraise files on configfs

Posted by Frederick Lawler 1 month, 1 week ago

When IMA appraises/measures a file configfs, it has an opportunity to
hold onto the ima_iint_mutex while another file from a different file
system is attempting to appraise/measure. This may cause a cyclical
lock dependency.

Add configfs to the default don't measure/appraise lists, similarly to
other pseudo file systems.

Link: https://lore.kernel.org/all/6a77c7cd.b50370da.49fe0.0031.GAE@google.com/#t

Signed-off-by: Frederick Lawler <fred@cloudflare.com>
---
Frederick Lawler (2):
      configfs: move CONFIGFS_MAGIC definition to magic.h
      ima: don't measure/appraise files on configfs

 fs/configfs/mount.c                 | 4 +---
 include/uapi/linux/magic.h          | 1 +
 security/integrity/ima/ima_policy.c | 7 ++++++-
 3 files changed, 8 insertions(+), 4 deletions(-)
---
base-commit: f1e10b10874051e4d99911dae0dd7b75a9f8ae66
change-id: 20260818-configfs-a248c410b083

Best regards,
-- 
Frederick Lawler <fred@cloudflare.com>