This patchset adds support for using fs-verity to validate lowerdata files by specifying an overlay.verity xattr on the metacopy files. This is primarily motivated by the Composefs usecase, where there will be a read-only EROFS layer that contains redirect into a base data layer which has fs-verity enabled on all files. However, it is also useful in general if you want to ensure that the lowerdata files matches the expected content over time. This patch series is based on the lazy lowerdata patch series by Amir[1]. I have also added some tests for this feature to xfstests[2]. I'm also CC:ing the fsverity list and maintainers because there is one (tiny) fsverity change, and there may be interest in this usecase. [1] https://lore.kernel.org/linux-unionfs/20230412135412.1684197-1-amir73il@xxxxxxxxx/T/#m1bc31eb75dc9dd22204b8f0cfc67bad9b6c785a7 [2] https://github.com/alexlarsson/xfstests/commits/verity-tests Alexander Larsson (6): fsverity: Export fsverity_get_digest ovl: Break out ovl_entry_path_real() from ovl_i_path_real() ovl: Break out ovl_entry_path_lowerdata() from ovl_path_lowerdata() ovl: Add framework for verity support ovl: Validate verity xattr when resolving lowerdata ovl: Handle verity during copy-up Documentation/filesystems/overlayfs.rst | 33 +++++ fs/overlayfs/Kconfig | 14 ++ fs/overlayfs/copy_up.c | 27 ++++ fs/overlayfs/namei.c | 34 +++++ fs/overlayfs/overlayfs.h | 11 ++ fs/overlayfs/ovl_entry.h | 4 + fs/overlayfs/super.c | 49 +++++++ fs/overlayfs/util.c | 167 ++++++++++++++++++++++-- fs/verity/measure.c | 1 + 9 files changed, 332 insertions(+), 8 deletions(-) -- 2.39.2
