[OS-BUILD PATCHv4] redhat/dracut-virt.conf: add systemd-veritysetup module

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Emanuele Giuseppe Esposito <eesposit@xxxxxxxxxx>

redhat/dracut-virt.conf: add systemd-veritysetup module

Upstream Status: RHEL-Only

This driver, together with a specific kernel cmdline and separate partition
containing the verification hash produced by veritysetup, enables
root disk integrity protection for UKIs.

Also add the overlay driver to allow systemd.volatile=overlay to mount
an overlayfs on top of /. This will make the root disk again
writable, but all changes will be ephemeral.

Signed-off-by: Emanuele Giuseppe Esposito <eesposit@xxxxxxxxxx>

diff --git a/redhat/dracut-virt.conf b/redhat/dracut-virt.conf
index blahblah..blahblah 100644
--- a/redhat/dracut-virt.conf
+++ b/redhat/dracut-virt.conf
@@ -20,6 +20,9 @@ dracutmodules+=" virtiofs "
 # modules: use sysext images (see 'man systemd-sysext')
 dracutmodules+=" systemd-sysext "
 
+# modules: root disk integrity protection
+dracutmodules+=" systemd-veritysetup "
+
 # drivers: virtual buses, pci
 drivers+=" virtio-pci virtio-mmio "      # qemu-kvm
 drivers+=" hv-vmbus pci-hyperv "         # hyperv
@@ -34,5 +37,8 @@ drivers+=" xen-blkfront "                # xen
 # root encryption
 drivers+=" dm_crypt "
 
+# root disk integrity protection
+drivers+=" dm_verity overlay "
+
 # filesystems
 filesystems+=" vfat ext4 xfs overlay "

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3212

-- 
_______________________________________________
kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Index of Archives]     [Fedora General Discussion]     [Older Fedora Users Archive]     [Fedora Advisory Board]     [Fedora Security]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Mentors]     [Fedora Package Announce]     [Fedora Package Review]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Coolkey]     [Yum Users]     [Tux]     [Yosemite News]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [USB]     [Asterisk PBX]

  Powered by Linux