diff options
| author | Ayoub Zaki <ayoub.zaki@embetrix.com> | 2026-09-07 19:19:38 +0200 |
|---|---|---|
| committer | Mikulas Patocka <mpatocka@redhat.com> | 2026-09-21 16:11:39 +0200 |
| commit | bec2fa7bdf06d6523e40e05fd93117b0c1c8bd30 (patch) | |
| tree | b5525f0c864093423a7c973092e57ca5424db595 /drivers/md | |
| parent | 53064d23f00f1b921f9f08555bfc5a1b229664a5 (diff) | |
dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
Add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE Kconfig option. When enabled,
dm-verity always requires a valid root hash signature: require_signatures
defaults to true and can no longer be cleared on the command line. When
disabled, the existing require_signatures module parameter controls
enforcement.
Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Diffstat (limited to 'drivers/md')
| -rw-r--r-- | drivers/md/Kconfig | 14 | ||||
| -rw-r--r-- | drivers/md/dm-verity-verify-sig.c | 4 |
2 files changed, 16 insertions, 2 deletions
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index df27c7d066d2..9a90e81817c7 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -610,6 +610,20 @@ config DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING If unsure, say N. +config DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE + bool "Require dm-verity root hash signature verification" + depends on DM_VERITY_VERIFY_ROOTHASH_SIG + help + Reject dm-verity devices that are created without a valid root hash + signature. Without this, whether a signature is required is decided + at boot time by the dm_verity.require_signatures parameter which + defaults to off. + + Enabling this makes that parameter default to on and it can then no + longer be turned off. + + If unsure, say N. + config DM_VERITY_FEC bool "Verity forward error correction support" depends on DM_VERITY diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c index b2b55c41e2cb..aadcf5e4a47c 100644 --- a/drivers/md/dm-verity-verify-sig.c +++ b/drivers/md/dm-verity-verify-sig.c @@ -21,8 +21,8 @@ static bool dm_verity_keyring_unsealed __ro_after_init; module_param_named(keyring_unsealed, dm_verity_keyring_unsealed, bool, 0444); MODULE_PARM_DESC(keyring_unsealed, "Leave the dm-verity keyring unsealed"); -static bool require_signatures; -module_param(require_signatures, bool, 0444); +static bool require_signatures = IS_ENABLED(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE); +module_param(require_signatures, bool_enable_only, 0444); MODULE_PARM_DESC(require_signatures, "Verify the roothash of dm-verity hash tree"); |