[PATCH v2 0/2] ima: don't measure/appraise files on configfs

[Frederick Lawler <fred@cloudflare.com>]

IMA measurement of a configfs file causes process_measurement() to hold
iint->mutex while performing a kernel_read() to hash it, which re-enters
configfs's own file locking (buffer->mutex, frag_sem).

Separately, opening any file with O_TRUNC now causes ima_file_truncate()
to take iint->mutex to reset the cached action flags, while sb_writers is
already held for that mount.

When a configfs-backed nvmet namespace is involved, these two independent
lock chains combine into a cycle:

iint->mutex -> configfs locks -> subsys->lock -> sb_writers -> iint->mutex

Add configfs to the builtin don't measure/appraise rules, similarly to
other pseudo file systems, so IMA never takes iint->mutex for configfs
file in the first place. 

Link: https://lore.kernel.org/all/6a77c7cd.b50370da.49fe0.0031.GAE@google.com/#t

Signed-off-by: Frederick Lawler <fred@cloudflare.com>
---
Changes in v2:
- Add CONFIGFS_MAGIC to IMA documentation in patch 2 (per shashiko)
- Update cover letter + commit message as suggested
- Link to v1: https://lore.kernel.org/r/20260818-configfs-v1-0-a2329043cf86@cloudflare.com

---
Frederick Lawler (2):
      configfs: move CONFIGFS_MAGIC definition to magic.h
      ima: don't measure/appraise files on configfs

 Documentation/ABI/testing/ima_policy | 3 +++
 fs/configfs/mount.c                  | 4 +---
 include/uapi/linux/magic.h           | 1 +
 security/integrity/ima/ima_policy.c  | 7 ++++++-
 4 files changed, 11 insertions(+), 4 deletions(-)
---
base-commit: f1e10b10874051e4d99911dae0dd7b75a9f8ae66
change-id: 20260818-configfs-a248c410b083

Best regards,
-- 
Frederick Lawler <fred@cloudflare.com>