From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx2-f11.google.com (mail-yx2-f11.google.com [74.125.224.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BCC0364052 for ; Tue, 18 Aug 2026 19:35:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.139 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081729; cv=none; b=X/KLTBUWPWfEbvTp/EMVhLf8+3HKb46pfQ/yXPYANdfzeQYYygBTs75f6xkx8JJEVxgVWqRt9v7eGVwthSbEqZlCHybLTLMAR8NJzUYsWk4I2VQHUPVgA3Gmfa+zLc94oTjFFfE2Q90mpXDrmTsY0nbjqY4M/J8duyZyCxAancU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787081729; c=relaxed/simple; bh=Z1zkBNoqlTE7TFv8YEBzTzxz0vDSaujpRw+vu4hgGrI=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=eRsYwcfXUOPPXGNDuD6ZrD8Ky8ii/Z8eB2RRzXjGz+Gw1RPjx8PTXHQSGL/D1lDK0TkJa+FagXWLwVIQCy2+D+fCidnJhFsplJarTC4D+S69E6UwAimDGMRLlelyf65tHZgt/QJQ3vqNiW6cx9YwATd2MV25d86bBagtPIMEv+c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=WACtdxCv; arc=none smtp.client-ip=74.125.224.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="WACtdxCv" Received: by mail-yx2-f11.google.com with SMTP id 956f58d0204a3-66c70f9ad8aso240832d50.1 for ; Tue, 18 Aug 2026 12:35:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1787081727; x=1787686527; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=R5kxolr59Cxqsf3CsaETXDSp9QVWCGFYLmNRwAwnZ74=; b=WACtdxCvnctavIHavv3O3Mx0gLizOCABakxvxlrKZZg8+u0ju7cNdLFeqsXQH84FSw 5h+okGnqADtpuq2YbFHojUg6bq4C4BaS+vBraHaEmGjPWiHPGiepauRtMoTPlqvioZi+ 9kCgu43eZ8sBfv/FV9E/r2R4nal5SQ0Uktgs/mMeTR0Zb+0voVU5XKZWikbxGmFYP6e5 aNy2rAEkPs1hnQpAAIYqO7icB97u0NOJpBEKXaX9d0QD6taMTpJbZlPU0lH0qWhF2TDT qVA777IJn5uVt6kpzXSqK0ypOyUvUcqe2BVm3UbdKXbMmoGEqvwkJYW8N/aRu7zR5x0R BcxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787081727; x=1787686527; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=R5kxolr59Cxqsf3CsaETXDSp9QVWCGFYLmNRwAwnZ74=; b=A69/rsS//f+3Rgeyz7nBAPvVA3WDXHDrR3Uv/+Q++0O+aAgyZRkTzmUAqZXR9FGpJ3 ERzPuFyxcahig4AwmIV/K3CORVeZz+eJpGhjuurMlwr0L/5Q08hQLyo8iEuvZ0RCIP9D B89VH2Zq+gkz7dW2r1SQSFr65FRwXMJ5Qa1AQ0SjCZc5GzmByWyPfatN+bDwkrJ96LP2 E3eneDeLSP42qCNWgahP6nvOe/UgBn4MbWKqZpoO8LUbsy9TiiTgEW7zVl7oe3pivA6P pmE5E+wl39cIsXgZkTN/50YKig0RISh/xVYDEhGsSL8D4ykqRUNtFBrcTE1s3Quwh8PM 6uug== X-Gm-Message-State: AOJu0YxVFTrbBijdRa3M7G3Sp25pKx6rO7k4+3FBxOwtuu0JFL2LkekI Da9OdPbDGvm4SCi7RRec24+bfpgkQj5faYjanVLL7gNTfQsqnLRgL+lZa2TCXAwDhpc= X-Gm-Gg: AR+sD10RpenDPF7xF+/62QLYx0kBZYpnU+YDuoanQxHFwVbhZP8f6yubOTRz5oNtdFU vdT9tEOve/LOScPDR8oW7AVlKPm++eq3FcZ9sdNuPTvUvYXisG6G1o2OcWw6NHjKWMD6qInHEgP yI8qOmwKMqvWP0EnQQHYylB/7PkIZc8KYtz79djxK1MagE2p8B8AfsWyqV5JfFOIWOVHorYW6OY mxXl0vp0Oq6eYGRjr1t4do/aOXCu7Lsrzc0ji5zKYrVqJQOkV07tr7IGqQzl2NjLocucyqblEA3 tBzOJ0ttMCSL/LNKnV+QgySQuGcXbwUZiXFVz9vbxUYy6cSjbf4thhRzzb5xZNvwqWWTODLYw3W rtquV9GJ7zFdBKJfsvskuH0LK5Iote/fSQE3rz5BALdEe7xXXFcSjZJt+CtMUAkuYqtGgBCY8bE B9ynxDfKjKzKQkMB7rbrZbaHqBAd8LuhH2gcTAmKB4xwEYYwWvCg== X-Received: by 2002:a53:ca4b:0:b0:668:15aa:4f79 with SMTP id 956f58d0204a3-66cca5767bdmr67485d50.2.1787081727116; Tue, 18 Aug 2026 12:35:27 -0700 (PDT) Received: from [127.0.1.1] ([2a09:bac6:947f:3af::5e:52]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cb47809c6sm2795622d50.11.2026.08.18.12.35.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 12:35:26 -0700 (PDT) From: Frederick Lawler Subject: [PATCH 0/2] ima: don't measure/appraise files on configfs Date: Tue, 18 Aug 2026 14:35:14 -0500 Message-Id: <20260818-configfs-v1-0-a2329043cf86@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAPKzhGoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDC0ML3eT8vLTM9LRi3UQjE4tkE0ODJAMLYyWg8oKi1LTMCrBR0bG1tQB KyJxHWgAAAA== X-Change-ID: 20260818-configfs-a248c410b083 To: Andreas Hindborg , Breno Leitao , Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Eric Snowberg , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-team@cloudflare.com, Frederick Lawler , syzbot+448c2e24b1ceff13ed2a@syzkaller.appspotmail.com X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=971; i=fred@cloudflare.com; h=from:subject:message-id; bh=Z1zkBNoqlTE7TFv8YEBzTzxz0vDSaujpRw+vu4hgGrI=; b=owEBbQKS/ZANAwAKAasltHYDktNtAcsmYgBqhLP85sosKlBEoFU29UJl56lOKC/kkVBhV+r+9 2q37yvmgnKJAjMEAAEKAB0WIQTLNBqMVmu1PHvjOe2rJbR2A5LTbQUCaoSz/AAKCRCrJbR2A5LT bf55D/9zJDWzwTw0F8cSI2kW060svadBjhv31RuDFg0P2mYMzaWe1U7HCKOKEl4LHoVQ5+59vWB myjNmV9wrN0/lTnpp+vXv9FyMdiUZrYk7SR3UhHK3TKvDWyPwCs2AQ8eXQoJHfrfB72KtG1Wmwg kFb/3VYPiJ91mA6GST2sXPjvLpd1mvT6Ae2Cgc4gfXHZPT2CXBWIRMThY32+JRBR+o33rNIDhFS DMYnq0NTreBW4N7JmVGLyyMztvucHwq69d8cw0SQalS806tw32kvmLj7B01L9u/7Hs60fo6TTnY h7CyYFkFV2o9Am9ZyhZRHuLPMTNc+BFLM5l/aEbEzQIaKpCUeOxUHjBrQ7af+WX+tkxZWuez/xK BdgpIDm1Jgjx/xMMUae+T4n1+ATDfvYtfWOsvZ8P0jMJFiQsX4E/OMYMSwEB8JC50sqiMAMWTeT 470kLx6gh13qbkh9VCA3NBiFazh9D9TR5PtgoCqwRHZHvAW5iRPL7qdlOqQd2eNiDg/HrPUT2jG bftQrzmWv4+4bKDvr4QVXik4VqvZwgpvZJR4x5M+bS1ljznbNBc5SnTuN7/T5SykMylVKByPeFo wyinR5QhYps3p1Bnfhn1T2ChRPCYtOQSr8m6nphx7RPAC1H9+AQmlVVtUwsGBvhrOnfl24tReUv 2RJtjTyomFLfGtA== X-Developer-Key: i=fred@cloudflare.com; a=openpgp; fpr=CB341A8C566BB53C7BE339EDAB25B4760392D36D When IMA appraises/measures a file configfs, it has an opportunity to hold onto the ima_iint_mutex while another file from a different file system is attempting to appraise/measure. This may cause a cyclical lock dependency. Add configfs to the default don't measure/appraise lists, similarly to other pseudo file systems. Link: https://lore.kernel.org/all/6a77c7cd.b50370da.49fe0.0031.GAE@google.com/#t Signed-off-by: Frederick Lawler --- Frederick Lawler (2): configfs: move CONFIGFS_MAGIC definition to magic.h ima: don't measure/appraise files on configfs fs/configfs/mount.c | 4 +--- include/uapi/linux/magic.h | 1 + security/integrity/ima/ima_policy.c | 7 ++++++- 3 files changed, 8 insertions(+), 4 deletions(-) --- base-commit: f1e10b10874051e4d99911dae0dd7b75a9f8ae66 change-id: 20260818-configfs-a248c410b083 Best regards, -- Frederick Lawler