Adding support for dm-verity rootfs
This patch adds support for dm-verity backed squashfs rootfs. It allows the user to check for corruption of their filesystem. A more detailed description of dm-verity can be found here: https://source.android.com/security/verifiedboot/dm-verity.
A few things before this MR complete.
Currently veritysetup does not get added to the initramfs by live-boot.
Should this happen by cryptsetup-initramfs or by live-boot? A patch for live-build
to add dm-verity support automatically is nearly finished. Is the current layout
of the files image.hash
and image.roothash
ok?
Two new kernel command-line parameters are introduced.
First dm-verity-media
which can have a comma separated list of images that
support dm-verity paired with their root hash. live-boot assumes that the
dm-verity hash table is in the same directory as the image and is named
image.hash
. The root hash can be set to auto
then live-boot tries to use the
data stored in image.roothash
as root hash.
Usage: dm-verity-media=image:auto|image:root_hash[,image:auto|image:root_hash]
Example: dm-verity-media=filesystem.squashfs:auto
Second dm-verity-corruption
. By default dm-verity throws an IO error if a hash
is invalid. This option changes can that behavior to either ignore such errors
or restart the system.
Usage: dm-verity-corruption=ignore|restart
Example: dm-verity-corruption=ignore