From 15bdcd64cae034a6627bb006687de8eeebbe51ac Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Mon, 29 Jan 2024 17:53:02 +0100 Subject: [PATCH] lib: Add TRY_VERITY mount option This is useful if you know fs-verity digests exists, and you want to use them to detect accidental modification, but don't want the mount to fail on older kernels that don't support the verity mount option. Signed-off-by: Alexander Larsson --- libcomposefs/lcfs-mount.c | 8 ++++++-- libcomposefs/lcfs-mount.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/libcomposefs/lcfs-mount.c b/libcomposefs/lcfs-mount.c index caf4119c..2a3427ae 100644 --- a/libcomposefs/lcfs-mount.c +++ b/libcomposefs/lcfs-mount.c @@ -300,6 +300,9 @@ static errint_t lcfs_mount_ovl_legacy(struct lcfs_mount_state_s *state, char *im { struct lcfs_mount_options_s *options = state->options; + /* Note: We ignore the TRY_VERITY option for legacy mounts, as + it is hard to check if the option is supported. */ + bool require_verity = (options->flags & LCFS_MOUNT_FLAGS_REQUIRE_VERITY) != 0; bool readonly = (options->flags & LCFS_MOUNT_FLAGS_READONLY) != 0; @@ -373,6 +376,7 @@ static errint_t lcfs_mount_ovl(struct lcfs_mount_state_s *state, char *imagemoun bool require_verity = (options->flags & LCFS_MOUNT_FLAGS_REQUIRE_VERITY) != 0; + bool try_verity = (options->flags & LCFS_MOUNT_FLAGS_TRY_VERITY) != 0; bool readonly = (options->flags & LCFS_MOUNT_FLAGS_READONLY) != 0; cleanup_fd int fd_fs = syscall_fsopen("overlay", FSOPEN_CLOEXEC); @@ -394,10 +398,10 @@ static errint_t lcfs_mount_ovl(struct lcfs_mount_state_s *state, char *imagemoun if (res < 0) return -errno; - if (require_verity) { + if (require_verity || try_verity) { res = syscall_fsconfig(fd_fs, FSCONFIG_SET_STRING, "verity", "require", 0); - if (res < 0) + if (res < 0 && require_verity) return -errno; } diff --git a/libcomposefs/lcfs-mount.h b/libcomposefs/lcfs-mount.h index ad430989..73087d30 100644 --- a/libcomposefs/lcfs-mount.h +++ b/libcomposefs/lcfs-mount.h @@ -36,6 +36,7 @@ enum lcfs_mount_flags_t { LCFS_MOUNT_FLAGS_REQUIRE_VERITY = (1 << 0), LCFS_MOUNT_FLAGS_READONLY = (1 << 1), LCFS_MOUNT_FLAGS_IDMAP = (1 << 3), + LCFS_MOUNT_FLAGS_TRY_VERITY = (1 << 4), LCFS_MOUNT_FLAGS_MASK = (1 << 5) - 1, };