fix: ignore many more filesystems in IMA #6575
Conversation
| "dont_measure fsmagic=0xde5e81e4", // EFIVARFS_MAGIC | ||
| "dont_measure fsmagic=0x58465342", // XFS_MAGIC | ||
| "dont_measure fsmagic=0x794c7630", // OVERLAYFS_SUPER_MAGIC | ||
| "dont_measure fsmagic=0x858458f6", // BTRFS_SUPER_MAGIC |
There was a problem hiding this comment.
any links to where these magic numbers are from, the kernel docs doesn't seem to have ext4 ones, at least the one in the comment
There was a problem hiding this comment.
There was a problem hiding this comment.
ha... this one is wrong, I will fix it up, thanks for noticing that https://github.com/torvalds/linux/blob/master/include/uapi/linux/magic.h
There was a problem hiding this comment.
ok, now I'm more confused... I'll dig into that
There was a problem hiding this comment.
https://github.com/torvalds/linux/blob/v5.15/include/uapi/linux/magic.h we'd probably need this, since our kernel is 5.15
There was a problem hiding this comment.
I guess magics shouldn't change, they're derived from the filesystem superblock. should be better now
internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
Outdated
Show resolved
Hide resolved
smira
force-pushed
the
ima-dont-measure
branch
from
55f5efc
to
bd3bdf3
Compare
|
🆒 |
smira
force-pushed
the
ima-dont-measure
branch
from
bd3bdf3
to
7fb09c5
Compare
|
#6553 filer here. 😄 I notice in the list of excluded filesystems, FUSE isn't included. Is there a reason that can't be included as well, because a number of CSIs use FUSE under the covers, and I was reproducing the issue with one of those (https://github.com/yandex-cloud/k8s-csi-s3). |
good point, just missed, don't see any harm in including FUSE too |
smira
force-pushed
the
ima-dont-measure
branch
from
7fb09c5
to
e07077f
Compare
thanks, just added that as well |
Fixes siderolabs#6553 Talos itself defaults to XFS, so IMA measurements weren't done for Talos own filesystems. But many other solutions create by default ext4 filesystems, or it might be something mounted by other means. Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
smira
force-pushed
the
ima-dont-measure
branch
from
e07077f
to
d3cf061
Compare
|
/m |
Fixes #6553
Talos itself defaults to XFS, so IMA measurements weren't done for Talos own filesystems. But many other solutions create by default ext4 filesystems, or it might be something mounted by other means.
Signed-off-by: Andrey Smirnov andrey.smirnov@talos-systems.com