From: Tao Cui userxattr forces metacopy off, and copy-up only computes and stores the verity digest for metacopy inodes. With "userxattr,verity=on" (or verity=require) the mount succeeds, verity is advertised in mountinfo, but no digest is ever generated and no lowerdata is ever verified - the option silently does nothing: $ mount -t overlay ovl -o lowerdir=$l,upperdir=$u,workdir=$w,userxattr,verity=on /mnt (mount succeeds; after copy-up the upper inode carries only the origin xattr, no metacopy xattr, no digest) Follow the existing pattern for redirect_dir/metacopy and reject the explicit combination at parse time: $ mount -t overlay ovl -o lowerdir=$l,upperdir=$u,workdir=$w,userxattr,verity=on /mnt mount: /mnt: wrong fs type, bad option, bad superblock... overlayfs: conflicting options: userxattr,verity=on This does not affect per-file fs-verity on the lower layers used together with userxattr (e.g. fstests overlay/089): it only concerns the verity= mount option, whose copy-up digest semantics cannot be honored when userxattr forces metacopy off. Signed-off-by: Tao Cui --- fs/overlayfs/params.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c index c93fcaa45d4a..29dfc16fecc9 100644 --- a/fs/overlayfs/params.c +++ b/fs/overlayfs/params.c @@ -997,6 +997,11 @@ int ovl_fs_params_verify(const struct ovl_fs_context *ctx, pr_err("conflicting options: userxattr,metacopy=on\n"); return -EINVAL; } + if (config->verity_mode) { + pr_err("conflicting options: userxattr,verity=%s\n", + ovl_verity_mode(config)); + return -EINVAL; + } /* * Silently disable default setting of redirect and metacopy. * This shall be the default in the future as well: these -- 2.43.0