On 04/06/2014 12:11 AM, Shivaramakrishnan Vaidyanathan wrote: > I have few questions is this regard.I am ready to perform the offline > integrity check.I can have the image files in the nfs-share archived > live to another partition that is not mounted.Will I be able to > perform the integrity check at the block level in this case?Each time > virtual machine boots up,I need to be able to verify if the image was > the same as previous boot.> Is this achievable? > > Will these steps work? > 1. Image file (VM1 - Virtual hard disk file mounted in nfs share partition). > 2.I rsync the directory of nfs-share to another partition. > 3.Then whether I will be able to tell whether the virtual image file has been altered/changed from the previous boot? I am not sure if I understand what you are trying to do here but if it is file image (full device image shared on nfs) why not use simple gpg file signature and verify it before the VM boot? ... > Also I dont get the notion "Dm-verity was designed to provide verification of (read-only) device (to provide verified boot path), all IOs must go through dm-verity." The dm-verity was designed for ChromeOS for verified boot, IOW it verifies blocks on underlying block device on-the-fly (when system reads them through verity mapped device). This means, that the dm-verity must be underlying device for all read operations (to allow it stop reads once it detect wrong hash). I know documentation is terse but at least something is here http://code.google.com/p/cryptsetup/wiki/DMVerity (see Theory of operation). Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
