On Mon, 2024-04-15 at 14:57 +0200, Miklos Szeredi wrote: > On Mon, 15 Apr 2024 at 12:47, Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > It's queued in > > https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/ > > next- > > integrity branch and should be linux-next. > > Is there a document about ima/evm vs. overlayfs? Not yet. > > What exactly is it trying to achieve and how? Although "Changes to the underlying filesystems while part of a mounted overlay filesystem are not allowed.", from an integrity perspective these changes might affect overlay files. So they need to be detected and possibly re-measured, re- appraised, and/or re-audited [1, 2]. Saying, "If the underlying filesystem is changed, the behavior of the overlay is undefined, though it will not result in a crash or deadlock." does not address the concerns about the integrity of the overlay file being accessed. Initially we disabled EVM on overlay, since calculating the overlay EVM HMAC, could result in taking an invalid HMAC value and making it valid. Stefan's EVM patch set addresses this by only copying up the EVM portable & immutable signature [3, 4]. Lastly, if a file is being opened for read, but is already opened for write, or the reverse, the file measurement is meaningless. A violation is audited and the IMA measurement list is invalidated. This patch set similarly addresses the case where the underlying file is already opened for write and the overlay file is being opened for read. [1] Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for IMA") forced signature re-evaulation on every file access. [2] Commit b836c4d29f27 (ima: detect changes to the backing overlay file) [3] https://lore.kernel.org/linux-integrity/20231219175206.12342-1-zohar@xxxxxxxxxxxxx/ [4] https://lore.kernel.org/linux-integrity/20240223172513.4049959-1-stefanb@xxxxxxxxxxxxx/ thanks, Mimi
