Am 07.09.18 um 20:45 schrieb Mimi Zohar:
A small example for reproduction (on a system with IMA appraisal): # OVERLAYFS_TEST_DIR=`mktemp -d` # mkdir "${OVERLAYFS_TEST_DIR}/upper" # mkdir "${OVERLAYFS_TEST_DIR}/work" # mount -t overlay -o lowerdir=/etc,upperdir="${OVERLAYFS_TEST_DIR} /upper",workdir="${OVERLAYFS_TEST_DIR}/work" overlay /etc # # rm -f /etc/test.txt # echo Test > /etc/test.txt # cat /etc/test.txt cat: /etc/test.txt: Permission denied # ls -s /etc/test.txt 4 /etc/test.txt # <- The contents are there # getfattr -m . -d /etc/test.txt # # <- The hash isn'tThank you for providing the example. Also on a linux-4.18.0-rcX test kernel, the file hash isn't being written out either. The builtin "appraise_tcb" policy (eg. specified as "ima_policy=appraise_tcb" on the boot command) has a tmpfs dont_appraise rule.
Putting the mount point into /tmp may have been a bad example, however at least on my system /tmp is mounted from a btrfs subvolume. Same with /var, which I'm using for my personal tests.
Ignaz
