| Message ID | 1696457386-3010-12-git-send-email-wufan@linux.microsoft.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | Integrity Policy Enforcement LSM (IPE) | expand |
On Oct 4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: > > The device-mapper has a flag to mark targets as singleton, which is a > required flag for immutable targets. Without this flag, multiple > dm-verity targets can be added to a mapped device, which has no > practical use cases and will let dm_table_get_immutable_target return > NULL. This patch adds the missing flag, restricting only one > dm-verity target per mapped device. > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > --- > v1-v10: > + Not present > --- > drivers/md/dm-verity-target.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) This seems reasonable to me and matches with other users of DM_TARGET_IMMUTABLE. Alasdair, Mike, can we get an ACK on this? > diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c > index 26adcfea0302..80673b66c194 100644 > --- a/drivers/md/dm-verity-target.c > +++ b/drivers/md/dm-verity-target.c > @@ -1503,7 +1503,7 @@ int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i > > static struct target_type verity_target = { > .name = "verity", > - .features = DM_TARGET_IMMUTABLE, > + .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE, > .version = {1, 9, 0}, > .module = THIS_MODULE, > .ctr = verity_ctr, > -- > 2.25.1 -- paul-moore.com
On Mon, Oct 23, 2023 at 11:52 PM Paul Moore <paul@paul-moore.com> wrote: > On Oct 4, 2023 Fan Wu <wufan@linux.microsoft.com> wrote: > > > > The device-mapper has a flag to mark targets as singleton, which is a > > required flag for immutable targets. Without this flag, multiple > > dm-verity targets can be added to a mapped device, which has no > > practical use cases and will let dm_table_get_immutable_target return > > NULL. This patch adds the missing flag, restricting only one > > dm-verity target per mapped device. > > > > Signed-off-by: Fan Wu <wufan@linux.microsoft.com> > > --- > > v1-v10: > > + Not present > > --- > > drivers/md/dm-verity-target.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > This seems reasonable to me and matches with other users of > DM_TARGET_IMMUTABLE. > > Alasdair, Mike, can we get an ACK on this? A gentle ping with a reminder ... For reference, the full patchset can be found on lore at the link below: https://lore.kernel.org/linux-security-module/1696457386-3010-1-git-send-email-wufan@linux.microsoft.com/ > > diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c > > index 26adcfea0302..80673b66c194 100644 > > --- a/drivers/md/dm-verity-target.c > > +++ b/drivers/md/dm-verity-target.c > > @@ -1503,7 +1503,7 @@ int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i > > > > static struct target_type verity_target = { > > .name = "verity", > > - .features = DM_TARGET_IMMUTABLE, > > + .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE, > > .version = {1, 9, 0}, > > .module = THIS_MODULE, > > .ctr = verity_ctr, > > -- > > 2.25.1
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index 26adcfea0302..80673b66c194 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -1503,7 +1503,7 @@ int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned i static struct target_type verity_target = { .name = "verity", - .features = DM_TARGET_IMMUTABLE, + .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE, .version = {1, 9, 0}, .module = THIS_MODULE, .ctr = verity_ctr,
The device-mapper has a flag to mark targets as singleton, which is a required flag for immutable targets. Without this flag, multiple dm-verity targets can be added to a mapped device, which has no practical use cases and will let dm_table_get_immutable_target return NULL. This patch adds the missing flag, restricting only one dm-verity target per mapped device. Signed-off-by: Fan Wu <wufan@linux.microsoft.com> --- v1-v10: + Not present --- drivers/md/dm-verity-target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)