Re: [RFC 2/2] ima: Fix detection of read/write violations on stacked filesystems

[Miklos Szeredi]

On Mon, 15 Apr 2024 at 20:35, Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote:

> Although "Changes to the underlying filesystems while part of a mounted overlay
> filesystem are not allowed.", from an integrity perspective these changes might
> affect overlay files.  So they need to be detected and possibly re-measured, re-
> appraised, and/or re-audited [1, 2].

How are changes of non-overlay files detected?

Thanks,
Miklos