Eric Lee / smarc-fsl-linux-kernel

23 Aug, 2019

1 commit

  • 88cd3e6cf   dm verity: add root hash pkcs#7 signature verification ... Browse Code ยป

    The verification is to support cases where the root hash is not secured
    by Trusted Boot, UEFI Secureboot or similar technologies.

    One of the use cases for this is for dm-verity volumes mounted after
    boot, the root hash provided during the creation of the dm-verity volume
    has to be secure and thus in-kernel validation implemented here will be
    used before we trust the root hash and allow the block device to be
    created.

    The signature being provided for verification must verify the root hash
    and must be trusted by the builtin keyring for verification to succeed.

    The hash is added as a key of type "user" and the description is passed
    to the kernel so it can look it up and use it for verification.

    Adds CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG which can be turned on if root
    hash verification is needed.

    Kernel commandline dm_verity module parameter 'require_signatures' will
    indicate whether to force root hash signature verification (for all dm
    verity volumes).

    Signed-off-by: Jaskaran Khurana
    Tested-and-Reviewed-by: Milan Broz
    Signed-off-by: Mike Snitzer

    Jaskaran Khurana