Received-SPF: pass (google.com: domain of linux-kernel+bounces-5411-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
MIME-Version: 1.0
References: <20231219134901.96300-1-zohar@linux.ibm.com> <20231219134901.96300-3-zohar@linux.ibm.com>
In-Reply-To: <20231219134901.96300-3-zohar@linux.ibm.com>
From: Amir Goldstein <amir73il@gmail.com>
Date: Tue, 19 Dec 2023 16:47:14 +0200
Message-ID: <CAOQ4uxhti7BybvXKAxckQM3UghehVVEWD3Kod+55SL+i13-wog@mail.gmail.com>
Subject: Re: [PATCH 2/2] evm: add support to disable EVM on unsupported filesystems
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-unionfs@vger.kernel.org, linux-integrity@vger.kernel.org, 
	linux-kernel@vger.kernel.org, Christian Brauner <brauner@kernel.org>, 
	Seth Forshee <sforshee@kernel.org>, Roberto Sassu <roberto.sassu@huaweicloud.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 19, 2023 at 3:49=E2=80=AFPM Mimi Zohar <zohar@linux.ibm.com> wr=
ote:
>
> Don't verify, write, remove or update 'security.evm' on unsupported
> filesystems.
>
> Temporarily define overlayfs as an unsupported filesystem until
> a complete solution is developed.
>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
>  security/integrity/evm/evm_main.c | 35 ++++++++++++++++++++++++++++++-
>  1 file changed, 34 insertions(+), 1 deletion(-)
>
> diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/e=
vm_main.c
> index 02adba635b02..aa6d32a07d20 100644
> --- a/security/integrity/evm/evm_main.c
> +++ b/security/integrity/evm/evm_main.c
> @@ -151,6 +151,17 @@ static int evm_find_protected_xattrs(struct dentry *=
dentry)
>         return count;
>  }
>
> +static int is_unsupported_fs(struct dentry *dentry)
> +{
> +       struct inode *inode =3D d_backing_inode(dentry);
> +
> +       if (strcmp(inode->i_sb->s_type->name, "overlay") =3D=3D 0) {
> +               pr_info_once("overlayfs not supported\n");
> +               return 1;
> +       }

Please do not special case overlayfs in and please do not use the
fs name to detect support.

Please define an sb flag like SB_I_IMA_UNVERIFIABLE_SIGNATURE
to disable EVM and set this flag in ovl_fill_super().

Thanks,
Amir.