On Mon, 15 Apr 2024 at 20:35, Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > Although "Changes to the underlying filesystems while part of a mounted overlay > filesystem are not allowed.", from an integrity perspective these changes might > affect overlay files. So they need to be detected and possibly re-measured, re- > appraised, and/or re-audited [1, 2]. How are changes of non-overlay files detected? Thanks, Miklos
