linux

iv/linux

History

Alexander Larsson ae8cba4033 ovl: Add framework for verity support

This adds the scaffolding (docs, config, mount options) for supporting
the new digest field in the metacopy xattr. This contains a fs-verity
digest that need to match the fs-verity digest of the lowerdata
file. The mount option "verity" specifies how this xattr is handled.

If you enable verity ("verity=on") all existing xattrs are validated
before use, and during metacopy we generate verity xattr in the upper
metacopy file (if the source file has verity enabled). This means
later accesses can guarantee that the same data is used.

Additionally you can use "verity=require". In this mode all metacopy
files must have a valid verity xattr. For this to work metadata
copy-up must be able to create a verity xattr (so that later accesses
are validated). Therefore, in this mode, if the lower data file
doesn't have fs-verity enabled we fall back to a full copy rather than
a metacopy.

Actual implementation follows in a separate commit.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>

2023-08-12 19:02:38 +03:00

copy_up.c

ovl: implement lazy lookup of lowerdata in data-only layers

2023-06-19 14:01:14 +03:00

dir.c

ovl: store enum redirect_mode in config instead of a string

2023-06-19 14:02:01 +03:00

export.c

ovl: deduplicate lowerpath and lowerstack[]

2023-06-19 14:01:13 +03:00

file.c

overlayfs update for 6.5