Re: [RFC PATCH v9 10/16] dm-verity: consume root hash digest and signature data via LSM hook
Fan Wu <[email protected]> Wed, 1 Feb 2023 15:26:39 -0800
| Newsgroups | com.redhat.linux-audit,dev.linux.lists.dm-devel,org.kernel.vger.linux-block,org.kernel.vger.linux-doc,org.kernel.vger.linux-fscrypt,org.kernel.vger.linux-integrity,org.kernel.vger.linux-kernel,org.kernel.vger.linux-security-module |
|---|---|
| Message-ID | <20230201232639.GB9075@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net> |
On Tue, Jan 31, 2023 at 02:22:01PM +0100, Roberto Sassu wrote: > On Mon, 2023-01-30 at 14:57 -0800, Fan Wu wrote: > > From: Deven Bowers <[email protected]> > > > > dm-verity provides a strong guarantee of a block device's integrity. As > > a generic way to check the integrity of a block device, it provides > > those integrity guarantees to its higher layers, including the filesystem > > level. > > I think you could reuse most of is_trusted_verity_target(), in > particular dm_verity_get_root_digest(). > > And probably, the previous patch is not necessary. > > Roberto > Thanks for the info. This function seems could be used to get the roothash but for saving the signature we still need the hook function in the previous patch. -Fan -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit