From ae8cba4033bc16e8a07792428a48a50710cc0f3c Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Wed, 19 Apr 2023 13:44:21 +0200 Subject: ovl: Add framework for verity support This adds the scaffolding (docs, config, mount options) for supporting the new digest field in the metacopy xattr. This contains a fs-verity digest that need to match the fs-verity digest of the lowerdata file. The mount option "verity" specifies how this xattr is handled. If you enable verity ("verity=on") all existing xattrs are validated before use, and during metacopy we generate verity xattr in the upper metacopy file (if the source file has verity enabled). This means later accesses can guarantee that the same data is used. Additionally you can use "verity=require". In this mode all metacopy files must have a valid verity xattr. For this to work metadata copy-up must be able to create a verity xattr (so that later accesses are validated). Therefore, in this mode, if the lower data file doesn't have fs-verity enabled we fall back to a full copy rather than a metacopy. Actual implementation follows in a separate commit. Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Acked-by: Eric Biggers Signed-off-by: Amir Goldstein --- fs/overlayfs/overlayfs.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'fs/overlayfs/overlayfs.h') diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h index 9402591f12aa..34cc72f8fb6a 100644 --- a/fs/overlayfs/overlayfs.h +++ b/fs/overlayfs/overlayfs.h @@ -70,6 +70,12 @@ enum { OVL_XINO_ON, }; +enum { + OVL_VERITY_OFF, + OVL_VERITY_ON, + OVL_VERITY_REQUIRE, +}; + /* * The tuple (fh,uuid) is a universal unique identifier for a copy up origin, * where: -- cgit v1.2.3