Skip to content

Adding support for dm-verity rootfs

Thore Sommer requested to merge TS/live-boot:dm-verity into master

This patch adds support for dm-verity backed squashfs rootfs. It allows the user to check for corruption of their filesystem. A more detailed description of dm-verity can be found here: https://source.android.com/security/verifiedboot/dm-verity.

A few things before this MR complete. Currently veritysetup does not get added to the initramfs by live-boot. Should this happen by cryptsetup-initramfs or by live-boot? A patch for live-build to add dm-verity support automatically is nearly finished. Is the current layout of the files image.hash and image.roothash ok?

Two new kernel command-line parameters are introduced.

First dm-verity-media which can have a comma separated list of images that support dm-verity paired with their root hash. live-boot assumes that the dm-verity hash table is in the same directory as the image and is named image.hash. The root hash can be set to auto then live-boot tries to use the data stored in image.roothash as root hash.

Usage: dm-verity-media=image:auto|image:root_hash[,image:auto|image:root_hash]
Example: dm-verity-media=filesystem.squashfs:auto

Second dm-verity-corruption. By default dm-verity throws an IO error if a hash is invalid. This option changes can that behavior to either ignore such errors or restart the system.

Usage: dm-verity-corruption=ignore|restart
Example: dm-verity-corruption=ignore

Edited by Thore Sommer

Merge request reports

Loading