[f2fs-dev] [PATCH v2 08/12] fs-verity: add CRC-32C support

From: Eric Biggers Add CRC-32C support to fs-verity, to provide a faster alternative to SHA-256 for users who want integrity-only (not authenticity), i.e. who want to detect only accidental corruption, not malicious changes. CRC-32C is chosen over CRC-32 because the CRC-32C polynomial is

[f2fs-dev] [PATCH v2 11/12] ext4: add fs-verity read support

From: Eric Biggers Make ext4_mpage_readpages() verify data as it is read from fs-verity files, using the helper functions from fs/verity/. To be compatible with fscrypt, like in the corresponding f2fs patch this required refactoring the decryption workflow into a generic "post-read processing"

[f2fs-dev] [PATCH v2 02/12] fs-verity: add setup code, UAPI, and Kconfig

From: Eric Biggers Add the beginnings of fs-verity support, including: - The fs-verity Kconfig option (CONFIG_FS_VERITY) - The fs-verity UAPI declarations (uapi/linux/fsverity.h) - The internal API header for filesystems to use (linux/fsverity.h) - The "setup" code which parses the fs-verity

[f2fs-dev] [PATCH v2 10/12] ext4: add basic fs-verity support

From: Eric Biggers Add basic fs-verity support to ext4. fs-verity is a filesystem feature that enables transparent integrity protection and authentication of read-only files. It uses a dm-verity like mechanism at the file level: a Merkle tree is used to verify any block in the file in

[f2fs-dev] [PATCH v2 06/12] fs-verity: implement FS_IOC_MEASURE_VERITY ioctl

From: Eric Biggers Add a function for filesystems to call to implement the FS_IOC_MEASURE_VERITY ioctl. This ioctl retrieves the file measurement hash that fs-verity calculated for the given file and is enforcing for reads; i.e., reads that don't match this hash will fail. This ioctl can be

[f2fs-dev] [PATCH v2 09/12] fs-verity: support builtin file signatures

From: Eric Biggers For ease of use, add optional support for having fs-verity handle a portion of the authentication policy in the kernel. A ".fs-verity" keyring is created to which trusted X.509 certificates can be added; then a sysctl 'fs.verity.require_signatures' can be set to cause the

[f2fs-dev] [PATCH v2 07/12] fs-verity: add SHA-512 support

From: Eric Biggers Add SHA-512 support to fs-verity. This is primarily a demonstration of the (small) changes needed to support a new hash algorithm; it's anticipated that most users will still prefer SHA-256 due to the smaller space required to store the hashes, though some may prefer SHA-512.

[f2fs-dev] [PATCH v2 03/12] fs-verity: add MAINTAINERS file entry

From: Eric Biggers I'm volunteering to maintain fs-verity. It's been suggested to take fs-verity changes through the fscrypt git tree, but as these are logically independent features I suggest having a separate git tree for fs-verity. But I left the mailing list as linux-fscrypt for now.

[f2fs-dev] [PATCH v2 00/12] fs-verity: read-only file-based authenticity protection

Hello, This patchset implements fs-verity for ext4 and f2fs. fs-verity is similar to dm-verity, but implemented on a per-file basis: a Merkle tree is used to measure (hash) the file's data as it is paged in. ext4 and f2fs hide this Merkle tree beyond the end of the file, though other

[f2fs-dev] [PATCH v2 01/12] fs-verity: add a documentation file

From: Eric Biggers Add a documentation file for fs-verity, covering: - Introduction - Use cases - Metadata format - Merkle tree - fs-verity descriptor - fsveritysetup format - Filesystem support - ext4 - f2fs - User API - FS_IOC_ENABLE_VERITY - FS_IOC_MEASURE_VERITY

[f2fs-dev] [PATCH v2 04/12] fs-verity: add data verification hooks for ->readpages()

From: Eric Biggers Add functions that verify data pages that have been read from a fs-verity file, against that file's Merkle tree. These will be called from filesystems' ->readpage() and ->readpages() methods. Since data verification can block, a workqueue is provided for these methods to

[f2fs-dev] [PATCH v2 12/12] f2fs: fs-verity support

From: Eric Biggers Add fs-verity support to f2fs. fs-verity is a filesystem feature that enables transparent integrity protection and authentication of read-only files. It uses a dm-verity like mechanism at the file level: a Merkle tree is used to verify any block in the file in log(filesize)

[f2fs-dev] [PATCH v2 05/12] fs-verity: implement FS_IOC_ENABLE_VERITY ioctl

From: Eric Biggers Add a function for filesystems to call to implement the FS_IOC_ENABLE_VERITY ioctl. This ioctl enables fs-verity on a file, after userspace has appended verity metadata to it. This ioctl is documented in Documentation/filesystem/fsverity.rst; see there for more information.