On Mon, Jun 08, 2020 at 09:20:27AM -0700, Alexei Starovoitov wrote: > Take android for example. It can certify vmlinux, but not boot fs image. Huh? Yes it does, and for a while now. It uses Android uses dm-verity[1] and fs-verity[2]. [1] https://source.android.com/security/verifiedboot/dm-verity https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html [2] https://source.android.com/security/apksigning/v3 https://www.kernel.org/doc/html/latest/filesystems/fsverity.html -- Kees Cook
