From: Darrick J. Wong <djwong@xxxxxxxxxx>
Allow upgrading of filesystems to support verity.
Signed-off-by: Darrick J. Wong <djwong@xxxxxxxxxx>
---
man/man8/xfs_admin.8 | 6 ++++++
repair/globals.c | 1 +
repair/globals.h | 1 +
repair/phase2.c | 24 ++++++++++++++++++++++++
repair/xfs_repair.c | 11 +++++++++++
5 files changed, 43 insertions(+)
diff --git a/man/man8/xfs_admin.8 b/man/man8/xfs_admin.8
index 83f8fe88ff18..cd18c18fd1b5 100644
--- a/man/man8/xfs_admin.8
+++ b/man/man8/xfs_admin.8
@@ -209,6 +209,12 @@ The filesystem cannot be downgraded after this feature is enabled.
This upgrade is not possible if a realtime volume has already been added to the
filesystem.
This feature is not upstream yet.
+.TP 0.4i
+.B verity
+Enable fs-verity on the filesystem, which allows for sealing of regular file
+data with signed hashes.
+The filesystem cannot be downgraded after this feature is enabled.
+This feature is not upstream yet.
.RE
.TP
.BI \-U " uuid"
diff --git a/repair/globals.c b/repair/globals.c
index a50e4959cbc1..410c3cd39d05 100644
--- a/repair/globals.c
+++ b/repair/globals.c
@@ -59,6 +59,7 @@ bool add_rmapbt; /* add reverse mapping btrees */
bool add_parent; /* add parent pointers */
bool add_metadir; /* add metadata directory tree */
bool add_rtgroups; /* add realtime allocation groups */
+bool add_verity; /* add fs-verity support */
/* misc status variables */
diff --git a/repair/globals.h b/repair/globals.h
index 4f9683bda949..994ea2b4e946 100644
--- a/repair/globals.h
+++ b/repair/globals.h
@@ -100,6 +100,7 @@ extern bool add_rmapbt; /* add reverse mapping btrees */
extern bool add_parent; /* add parent pointers */
extern bool add_metadir; /* add metadata directory tree */
extern bool add_rtgroups; /* add realtime allocation groups */
+extern bool add_verity; /* add fs-verity support */
/* misc status variables */
diff --git a/repair/phase2.c b/repair/phase2.c
index d1b2824caace..f8b0fefe3bc0 100644
--- a/repair/phase2.c
+++ b/repair/phase2.c
@@ -429,6 +429,28 @@ set_rtgroups(
return true;
}
+static bool
+set_verity(
+ struct xfs_mount *mp,
+ struct xfs_sb *new_sb)
+{
+ if (xfs_has_verity(mp)) {
+ printf(_("Filesystem already supports verity.\n"));
+ exit(0);
+ }
+
+ if (!xfs_has_crc(mp)) {
+ printf(
+ _("Verity feature only supported on V5 filesystems.\n"));
+ exit(0);
+ }
+
+ printf(_("Adding verity to filesystem.\n"));
+ new_sb->sb_features_ro_compat |= XFS_SB_FEAT_RO_COMPAT_VERITY;
+ new_sb->sb_features_incompat |= XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR;
+ return true;
+}
+
struct check_state {
struct xfs_sb sb;
uint64_t features;
@@ -868,6 +890,8 @@ upgrade_filesystem(
dirty |= set_metadir(mp, &new_sb);
if (add_rtgroups)
dirty |= set_rtgroups(mp, &new_sb);
+ if (add_verity)
+ dirty |= set_verity(mp, &new_sb);
if (!dirty)
return;
diff --git a/repair/xfs_repair.c b/repair/xfs_repair.c
index faaea4d45224..ab6f97157f1b 100644
--- a/repair/xfs_repair.c
+++ b/repair/xfs_repair.c
@@ -77,6 +77,7 @@ enum c_opt_nums {
CONVERT_PARENT,
CONVERT_METADIR,
CONVERT_RTGROUPS,
+ CONVERT_VERITY,
C_MAX_OPTS,
};
@@ -92,6 +93,7 @@ static char *c_opts[] = {
[CONVERT_PARENT] = "parent",
[CONVERT_METADIR] = "metadir",
[CONVERT_RTGROUPS] = "rtgroups",
+ [CONVERT_VERITY] = "verity",
[C_MAX_OPTS] = NULL,
};
@@ -438,6 +440,15 @@ process_args(int argc, char **argv)
_("-c rtgroups only supports upgrades\n"));
add_rtgroups = true;
break;
+ case CONVERT_VERITY:
+ if (!val)
+ do_abort(
+ _("-c verity requires a parameter\n"));
+ if (strtol(val, NULL, 0) != 1)
+ do_abort(
+ _("-c verity only supports upgrades\n"));
+ add_verity = true;
+ break;
default:
unknown('c', val);
break;
