Re: overlayfs-etc on top of dm-verity?

Hi Ayoub,

On 3/27/26 2:26 PM, Ayoub Zaki wrote:
> Hi Michael,
> From a security perspective I would strongly advise against overlaying 
> the entire /etc as it undermines the integrity provided by secure 
> boot. Instead only overlay the specific files that actually need to be 
> modified. In addition, consider enforcing integrity protection on the 
> upper layer and consider alternatively switch to bind mounts for those 
> files.
>
Thanks for the advice and reminder! This definitely makes sense and I'll 
review which /etc files we need to modify, if any. I initially suggested 
this to allow for changing root/user passwords at first boot, but we may 
be able to do without users and passwords after all.

Cheers
Michael.

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com