mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 03:40:04 +00:00
c93d8f8858
Add most of fs-verity support to ext4. fs-verity is a filesystem feature that enables transparent integrity protection and authentication of read-only files. It uses a dm-verity like mechanism at the file level: a Merkle tree is used to verify any block in the file in log(filesize) time. It is implemented mainly by helper functions in fs/verity/. See Documentation/filesystems/fsverity.rst for the full documentation. This commit adds all of ext4 fs-verity support except for the actual data verification, including: - Adding a filesystem feature flag and an inode flag for fs-verity. - Implementing the fsverity_operations to support enabling verity on an inode and reading/writing the verity metadata. - Updating ->write_begin(), ->write_end(), and ->writepages() to support writing verity metadata pages. - Calling the fs-verity hooks for ->open(), ->setattr(), and ->ioctl(). ext4 stores the verity metadata (Merkle tree and fsverity_descriptor) past the end of the file, starting at the first 64K boundary beyond i_size. This approach works because (a) verity files are readonly, and (b) pages fully beyond i_size aren't visible to userspace but can be read/written internally by ext4 with only some relatively small changes to ext4. This approach avoids having to depend on the EA_INODE feature and on rearchitecturing ext4's xattr support to support paging multi-gigabyte xattrs into memory, and to support encrypting xattrs. Note that the verity metadata *must* be encrypted when the file is, since it contains hashes of the plaintext data. This patch incorporates work by Theodore Ts'o and Chandan Rajendra. Reviewed-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Eric Biggers <ebiggers@google.com>
16 lines
580 B
Makefile
16 lines
580 B
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the linux ext4-filesystem routines.
|
|
#
|
|
|
|
obj-$(CONFIG_EXT4_FS) += ext4.o
|
|
|
|
ext4-y := balloc.o bitmap.o block_validity.o dir.o ext4_jbd2.o extents.o \
|
|
extents_status.o file.o fsmap.o fsync.o hash.o ialloc.o \
|
|
indirect.o inline.o inode.o ioctl.o mballoc.o migrate.o \
|
|
mmp.o move_extent.o namei.o page-io.o readpage.o resize.o \
|
|
super.o symlink.o sysfs.o xattr.o xattr_trusted.o xattr_user.o
|
|
|
|
ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o
|
|
ext4-$(CONFIG_EXT4_FS_SECURITY) += xattr_security.o
|
|
ext4-$(CONFIG_FS_VERITY) += verity.o
|