From nobody Mon Sep 28 18:33:56 2026 Received: from mail-yw1-f171.google.com (mail-yw1-f171.google.com [209.85.128.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0ECB36EAA4 for ; Tue, 18 Aug 2026 19:35:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081732; cv=none; b=NeEOGrbXwOnGrmOIlWkzKl5Im425NcUx3nTTHv7w+ao4bAfZj9qNoOMM5Fi63KqJpZhFTW8IJjemmgPgPc9qnOceB5Iv4aTV5p+uTfVjRoGHbq4Nl8Po9Ct2rH50dN34+4sOQ2chBCGAtCNHguvgxRimraDCXwkcczj0WNUtkoc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081732; c=relaxed/simple; bh=4Dr8FUckZZs6x07b+xsKvc6HgeTnce7Z1vxgvZfvoJU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=j9CPpfBE8OMVVy06pDstMsAyiDK6kSdLkL8E7WFAD5FliF2jToK06wPCLJH5Zo4zjhCcct8ZkRYe9R2dz7zO0LbgpYuvWzJiffcjsDN2XnZCaIQtWB22BAABwpBwBYSrNRjTHqpN3DRZK8ac5lflRgRvVNEELWkB7wSbwQHgu58= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=ZFAwIJUX; arc=none smtp.client-ip=209.85.128.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="ZFAwIJUX" Received: by mail-yw1-f171.google.com with SMTP id 00721157ae682-836ccf53ef9so3765257b3.1 for ; Tue, 18 Aug 2026 12:35:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1787081729; x=1787686529; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rXoczBGO5I6N9TIC59uDIKSOp13YmyqaSWTBgCd4pCI=; b=ZFAwIJUXkjrCH8wddjUm4XfqvqvcqX9lsBKwOOmSsaNqTECOTB04LXgF4WbHbpfMWI QxeGH1aXcpi+um7atjAIOZcx3uAzeePU02P6WBSocdCKRRZ9TS8cd7Qcyr/T8UeB/JRL rwe0q4dsZqeYFFMg2r/YjFmmw83WPZ8whBw/Yw6V3zHB/HWRGUEu9e9BHm1SCGoT58ds Z3IRAgaUOyEjb3VAfZUA4jJJE0Bg+TJRMT0F1mmVAYwi9iAKmFM2PR+qnMiaHQYRPvJl WuXs8uFsUJTlr28hZnU/9GGCNzWzlcQLqZpaYngpiEmZ98tw/UGBTHAuYFThldRjINYS vSzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787081729; x=1787686529; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=rXoczBGO5I6N9TIC59uDIKSOp13YmyqaSWTBgCd4pCI=; b=lVzcP9+ugdyOR52mUhpjaCHySB1Z7cSCAODKhAr1sFR8xgWez7N4xNvmYeND2vFPqP t98VXf2WUViOgROAO/rwEIifv7L8pl5/0lNobDlpfWgwegoHo28hzTMaq8mJBO3Fx4ep 9vBMI7NA+kIpz4WoHhh217OC7yN7xld1XmO3n3VCExf4HDOvXpItNd98A+Jk4vwLPiyL aWVGVMLoZh9t/sPYiCXINmdyK4ZgAnkTH5liuhFGf5fEMMFMmrTWlkhuCp0h74Cyp2wk XcHLoOfuTKu58yzK6BDka1CvU9s6nbncMzFcRtWEKPvNRY1z1oPau4q5PSkK8e1pBVXY lzSw== X-Gm-Message-State: AOJu0YxAgsa8CaEZAaRsW6t6Rd/luEUp33wqze3EU6pT7nv8M2l/mRvw RG+ApMm+pB8U3D11b3kNs99pKggD26Xo7Td0ooMJPjt0x3UuVMSYs1DyjSJnu7yY12Y= X-Gm-Gg: AR+sD13dmlnBUCK0vQcaXVHfce7z2FfA9/K/AdN+SHgqSSd7U6fZL6H7EApi4oI3X7G 1UWTDganHRB2QlTqOr5MS+P+0Eaqgx8UVqsWagBs8SeNara67KY+DMIE2MXHL3+izv2EaY6tXLJ YKvz12eEoFrJnWqkL7tZ+uk611SAlhmdec+IpjjLIg8Q67VN7n+r5FrSpf1RU1s5uNETrqdjkuX Sc9wCdi0wDMeY8AlatwAjX9eLWOBnrppUKfAkyEEdPMq+9x5ikT0vH8PQYiQfETM87PsUUaWFfo yrqIIPiUMfTVUWKnvyNdlTCU8mY3j2Z9CqQyYBxNCwW0avwBi3MGxP2eqdwUMMzoAem3A5ZR+EQ OIIjuNBswFB1z0WrdsgWuISVG4iBf1yT7lc5XOAFQrMIf+QY+vl4KzbklqfM93YpKdO418Gi9SG RQVTG+svBiF0d8lwqtxnCtF+HyVmB6RUa6BVatUapp5VAx X-Received: by 2002:a53:a60b:0:b0:66c:85e3:7f45 with SMTP id 956f58d0204a3-66cca5a58bbmr59786d50.49.1787081728671; Tue, 18 Aug 2026 12:35:28 -0700 (PDT) Received: from [127.0.1.1] ([2a09:bac6:947f:3af::5e:52]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cb47809c6sm2795622d50.11.2026.08.18.12.35.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 12:35:28 -0700 (PDT) From: Frederick Lawler Date: Tue, 18 Aug 2026 14:35:15 -0500 Subject: [PATCH 1/2] configfs: move CONFIGFS_MAGIC definition to magic.h Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260818-configfs-v1-1-a2329043cf86@cloudflare.com> References: <20260818-configfs-v1-0-a2329043cf86@cloudflare.com> In-Reply-To: <20260818-configfs-v1-0-a2329043cf86@cloudflare.com> To: Andreas Hindborg , Breno Leitao , Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Eric Snowberg , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-team@cloudflare.com, Frederick Lawler X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=1753; i=fred@cloudflare.com; h=from:subject:message-id; bh=4Dr8FUckZZs6x07b+xsKvc6HgeTnce7Z1vxgvZfvoJU=; b=owEBbQKS/ZANAwAKAasltHYDktNtAcsmYgBqhLP9geiL+zExdgGlu6I2vB3H1Nmq+DpnXKnnD iOAuL1cpp2JAjMEAAEKAB0WIQTLNBqMVmu1PHvjOe2rJbR2A5LTbQUCaoSz/QAKCRCrJbR2A5LT bdKiEADoWx9BRs0O46WPuq+MDXdp1N3M3QreUWuMnNAVw4Ky/3IG8DmWgIoGxMzcRZomE4vNk8t MGT3K7t6DZ4x6Yvd4gbP0pgLdrUnWzXfFrThoa3SW2icHYtdAwW8DbK5IWIob7zTAmVqLXRYiOe UmZRlFjAnTzu0uthejnbCkoFxy08oiO7aOx4pVVCbFD3PgAhvEzfLO5BW9UGncde9eNlzzeNRr/ MVB+F71zPn+88yiYeEvTPydnRUss7ODtt+vXaAIhMjrSgQOSmiyvCzUAD7bUuws3JD5yT/V89v+ s2CvnIv/9Tr0MUxfBLsPuXTskoiMzGTDcm445BkW/66k4SmpJts/a+7Mz3GW3P5jA/NMFsTPZ9l QNcMit0wuUw9vwZbF8CC+g0StQgmzHoYMqrLRB2+fJIA5iRUi+7pu8pgY6DqJeGVmLfC1BjwX8f yd/prGfsdrQj/HFoSQH+fQPYDhtOu0m1Hxn09ZC9Be7m712GPcCI36GwplkjO2wMCbuPvAflmNR cw4xKhMkoCpBBQAlKCwf36L3j8lnGjPjqtRdmohqkDic0w50IKG9dEhRGbl+XNlXFxj5OGzz+uL yKq8Oyr1hgRj8eQVketEXTF6LXlW7Y3IylTPq3JgT3PV3BsRxqrqLlDYZnHcegUJBZWRg2HQ3l/ bW+kURz9M4JVg4g== X-Developer-Key: i=fred@cloudflare.com; a=openpgp; fpr=CB341A8C566BB53C7BE339EDAB25B4760392D36D IMA shouldn't measure or appraise configfs, but currently does because it's missing from the default exclusion policies. Move CONFIGFS_MAGIC to magic.h to expose the file system's magic to IMA, as well as other userland applications. Suggested-by: Mimi Zohar Signed-off-by: Frederick Lawler Reviewed-by: Breno Leitao --- fs/configfs/mount.c | 4 +--- include/uapi/linux/magic.h | 1 + 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c index 4929f343118946eaa55a539db4192e9c6621a8dc..d8cac1cbf3bd573a0549f2f0447= 14c9d669205a4 100644 --- a/fs/configfs/mount.c +++ b/fs/configfs/mount.c @@ -9,6 +9,7 @@ */ =20 #include +#include #include #include #include @@ -19,9 +20,6 @@ #include #include "configfs_internal.h" =20 -/* Random magic number */ -#define CONFIGFS_MAGIC 0x62656570 - static struct vfsmount *configfs_mount =3D NULL; struct kmem_cache *configfs_dir_cachep; static int configfs_mnt_count =3D 0; diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h index 4f2da935a76ccae6e1c3310b2fae5379186548b8..d5b9958ddfaae90b270b66fe785= 3c5a3d49ce739 100644 --- a/include/uapi/linux/magic.h +++ b/include/uapi/linux/magic.h @@ -8,6 +8,7 @@ #define AUTOFS_SUPER_MAGIC 0x0187 #define CEPH_SUPER_MAGIC 0x00c36400 #define CODA_SUPER_MAGIC 0x73757245 +#define CONFIGFS_MAGIC 0x62656570 /* some random number */ #define CRAMFS_MAGIC 0x28cd3d45 /* some random number */ #define CRAMFS_MAGIC_WEND 0x453dcd28 /* magic number with the wrong endian= ess */ #define DEBUGFS_MAGIC 0x64626720 --=20 2.43.0 From nobody Mon Sep 28 18:33:56 2026 Received: from mail-yx2-f9.google.com (mail-yx2-f9.google.com [74.125.224.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5A37372056 for ; Tue, 18 Aug 2026 19:35:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.137 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081734; cv=none; b=CCzNMctevSsuUKch52Fz5VqeGD6BMOhOSgloM57JYNfTFxpBoCjZ4i94FpeaBfYBrVCZs8bpmcrsewQyYIaqniHuGywZ7vGXko84YRiMBY/dC94z0GdfSb85NJZfHNvfexvdlMloHi/EOvYEkRtDBQTwNzKsclPPlVsXg9/zoF0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081734; c=relaxed/simple; bh=7LZjP32jUfaZ5RKmBNaB9NcgyxlHRwbSA/1nT2Radhc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=LarGoV7+r6IgTA6Y41y1lYJ2VxxG2o54OkfXw7/NT4OrYlCrnBm8hsbaYIZX1JXiucOIPE5Pt2tOpOUAmMGrzKBiSZOZBSXzf2TQcpgR+ICh1y02NTY0yARE9fT0emRZiTbmOij8h8z2xzD6RVL09tbGKM1Rs+/8eTizU7yuXeg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=HXaYmoUt; arc=none smtp.client-ip=74.125.224.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="HXaYmoUt" Received: by mail-yx2-f9.google.com with SMTP id 956f58d0204a3-66c711552ccso409571d50.1 for ; Tue, 18 Aug 2026 12:35:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1787081731; x=1787686531; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3UXJUp6qjJ2HIYsQIMwEd5fSfbeRNaFsH8a8Xw28Ey4=; b=HXaYmoUtBoAj1nnNe0YyIgi7sRHAU31p9sq6rkC8N4iIBoSfZD/vFRG33g0Tio3fIb KErGPdd1qvTTHtwWmPr+cYPVt/KkA3WVDscLQzGeP6X0Zj7ZV85vEmGiWz8SsAlJJNvv Yh17WFGug6XbGqFODcskEj0pSav6OA7xpUkOfR9FymM+z6JEphP/e4WE7j4XunJ8sCQw r2TmqVUOqds1Po05fylbua3tbob6tslUAvE6/heU2EvkRuKH8plQlWgHxdnJT+fmAoMH b2hobCtE3bHMuQBFTUnlFguTV6aBcUgBEAAdoewoG8beIMlTQcG70qF1MOusxrytrhdH d36w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787081731; x=1787686531; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3UXJUp6qjJ2HIYsQIMwEd5fSfbeRNaFsH8a8Xw28Ey4=; b=m6AZIDnnFUEAwuZ238LsIdVDNmQxgSrzij3uX/cNM8rlGCoDzsvMsAkVdfmCE3iUaA 95NVoY6tYtC4vFc1PbAF0pJ5dNdWd6UWGF88PzE7NGD8YvyuOxMRX4pZpux0WmpWM0Qk o44Fy2lT0nbcW+MAYIOWNBMGnn47EXO+o+vH3jQ+UVV/NpQsRCXvNsjWT3Kvc8ajhcxU TcO/I0/NCUgtEygKfIcWu31b6GQbSjRGWoevek384Ko1CiIPZs1WuJSADl5TYWhQc+Mn e0HIPVSIq9lhcEODEOKFpbNEPUp6qydWI/pQsF2LFTtnlDbEi+8Vx44zhPFcoLvRZ+Vq n3Qg== X-Gm-Message-State: AOJu0YyxLk/D+tFHDdOfQd0oqYhc8Umo7lKaxZQ2NyXsYgUoWlXsS1YV 4QqepHOyVK9+1A+tfxSJo1FYRqyWDtocobJ+ABqJOHzYge/rczJFCDcLt29eIsFMoJE= X-Gm-Gg: AR+sD1296j5acAjh69UfbX4Fr+g/+VS9QhnkjeyD79lBdCE8LwvjAfZzZhaEe3SneBw cIl8toODtihejvtZ9RkWBNwiY0u3eE2cJdKd4SNSCo4AHPDyVYVkn1ZMyk4AIwJ669ZYaqQDccR OL1MN6VBTqHnIFi3YTrZYevd3yxNBPdnsEi6XCr42lLaJCDBRtqNQDieuCeIKGWglqiGH5mefXJ 4nrIDo5aoJMAf3hdjW7ScuG6XrzWVCBEREI9/MbRsvGxoWy7hucqkKOmoS5W2KmOUd+5cKmQus2 grJVcQr445FwMonIiIzue10yFX1X2LquFj9TGOpjbMok751sd96Yduu72UWvypSVLFOs5D6gy4a OaIn8zpvFD501WP/mFBCTb4Cur87DrOoOkAy/caTMoQF4jEhEF/w2JFgUymPvASDK4NeiFy/ZU0 eDY/XEr+v2kpQe2A2gpf0bojMzMNm1UwaDzZPt3fhTY06I2TJHOdTE4EU= X-Received: by 2002:a53:bc0c:0:b0:66b:3c40:17e0 with SMTP id 956f58d0204a3-66cca5db977mr58091d50.43.1787081730600; Tue, 18 Aug 2026 12:35:30 -0700 (PDT) Received: from [127.0.1.1] ([2a09:bac6:947f:3af::5e:52]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cb47809c6sm2795622d50.11.2026.08.18.12.35.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 12:35:29 -0700 (PDT) From: Frederick Lawler Date: Tue, 18 Aug 2026 14:35:16 -0500 Subject: [PATCH 2/2] ima: don't measure/appraise files on configfs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260818-configfs-v1-2-a2329043cf86@cloudflare.com> References: <20260818-configfs-v1-0-a2329043cf86@cloudflare.com> In-Reply-To: <20260818-configfs-v1-0-a2329043cf86@cloudflare.com> To: Andreas Hindborg , Breno Leitao , Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Eric Snowberg , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-team@cloudflare.com, Frederick Lawler , syzbot+448c2e24b1ceff13ed2a@syzkaller.appspotmail.com X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2105; i=fred@cloudflare.com; h=from:subject:message-id; bh=7LZjP32jUfaZ5RKmBNaB9NcgyxlHRwbSA/1nT2Radhc=; b=owEBbQKS/ZANAwAKAasltHYDktNtAcsmYgBqhLP9Vx66id6HzUGNVJl0dOeeNDs0MBZQgcfLJ ozGhqJGiNaJAjMEAAEKAB0WIQTLNBqMVmu1PHvjOe2rJbR2A5LTbQUCaoSz/QAKCRCrJbR2A5LT bQVIEAC1Z72vgOQ5JGNsxpTTajJOI51TP6Rnol/Bx7J2tcFGgHnnHtMnf5fd/EDtCDec5qNK4cb rhvU/uwkK0HBll+nTe32AAgK9R7ABEF34DZPls68z5hz5cJPyNvpfDY/n6SkHkxT+DjKfgK8qPz oMmLJs7AgQvQRBjF/YFZbFFvWOGkz8tJ2ar1Bz1bf31+CgbqwIKakWokyp92wdjbXdCIyor5Ovo fOpsgCFUEZjgvovWR1w2ITdKCu6rn29UldScCH1TdpmE523wL/POA8NSV2060fEpzuLcP27mAPD IDes0e25PVxznRDQ0tY3foFCVaH06CZqy3sT7KkFq47z0enMvmF0nzn0LPLz0mgvjV74WkDWYay igd9xjoO+4W6WfzNd4FHague17tw43Gyaigmcc4PWvAZCojhOL5mf8/t8rRuBF8z/afkKdAlHCB VC5vtDKqpHvAobWdA7m/+hytXaS5lNB9GtQYQn4kyfdUw1m2ObL+grd22K3OgtFKFPVxbJ70Er0 cfK8N98igspB5ILoHEIrkJ47vQBBIspKykEujbZisq2n36e7XRxC0F5ZyLWH33Hyt7hq256MJ5J jisxr61kCS5tdm5bGlIBi4Fb3AjSH1qVmtN29IRONnbbsuJxZl4jLxDVCn7Ukww5lQtwbN8P682 qIzx3FXQQ1caHTw== X-Developer-Key: i=fred@cloudflare.com; a=openpgp; fpr=CB341A8C566BB53C7BE339EDAB25B4760392D36D When IMA appraises/measures a file configfs, it has an opportunity to hold onto the ima_iint_mutex while another file from a different file system is attempting to appraise/measure. This may cause a cyclical lock dependency. Add configfs to the default don't measure/appraise lists, similarly to other pseudo file systems. Reported-by: syzbot+448c2e24b1ceff13ed2a@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/6a77c7cd.b50370da.49fe0.0031.GAE@google.c= om/ Suggested-by: Mimi Zohar Signed-off-by: Frederick Lawler --- security/integrity/ima/ima_policy.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/i= ma_policy.c index f79d07bb63c6fc4ba6fe594140de8d59f57e4f0b..68d9a5e6c232ea0678e9f51f105= cebecccccb43e 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -165,7 +165,10 @@ static struct ima_rule_entry dont_measure_rules[] __ro= _after_init =3D { {.action =3D DONT_MEASURE, .fsmagic =3D CGROUP2_SUPER_MAGIC, .flags =3D IMA_FSMAGIC}, {.action =3D DONT_MEASURE, .fsmagic =3D NSFS_MAGIC, .flags =3D IMA_FSMAGI= C}, - {.action =3D DONT_MEASURE, .fsmagic =3D EFIVARFS_MAGIC, .flags =3D IMA_FS= MAGIC} + {.action =3D DONT_MEASURE, .fsmagic =3D EFIVARFS_MAGIC, + .flags =3D IMA_FSMAGIC}, + {.action =3D DONT_MEASURE, .fsmagic =3D CONFIGFS_MAGIC, + .flags =3D IMA_FSMAGIC} }; =20 static struct ima_rule_entry original_measurement_rules[] __ro_after_init = =3D { @@ -211,6 +214,8 @@ static struct ima_rule_entry default_appraise_rules[] _= _ro_after_init =3D { {.action =3D DONT_APPRAISE, .fsmagic =3D EFIVARFS_MAGIC, .flags =3D IMA_F= SMAGIC}, {.action =3D DONT_APPRAISE, .fsmagic =3D CGROUP_SUPER_MAGIC, .flags =3D I= MA_FSMAGIC}, {.action =3D DONT_APPRAISE, .fsmagic =3D CGROUP2_SUPER_MAGIC, .flags =3D = IMA_FSMAGIC}, + {.action =3D DONT_APPRAISE, .fsmagic =3D CONFIGFS_MAGIC, + .flags =3D IMA_FSMAGIC}, #ifdef CONFIG_IMA_WRITE_POLICY {.action =3D APPRAISE, .func =3D POLICY_CHECK, .flags =3D IMA_FUNC | IMA_DIGSIG_REQUIRED}, --=20 2.43.0