All of lore.kernel.org
 help / color / mirror / Atom feed
From: Milan Broz <gmazyland@gmail.com>
To: Shivaramakrishnan Vaidyanathan <shivaramakrishnan740@gmail.com>
Cc: dm-crypt@saout.de
Subject: Re: [dm-crypt] verity setup on active device.
Date: Sun, 06 Apr 2014 09:44:06 +0200	[thread overview]
Message-ID: <534105C6.3060305@gmail.com> (raw)
In-Reply-To: <CAAQucXZ7tD20P3PZ1o-tVpjwH=c_bstKvG+7crxe9PiR7_u7ew@mail.gmail.com>

On 04/06/2014 12:11 AM, Shivaramakrishnan Vaidyanathan wrote:
> I have few questions is this regard.I am ready to perform the offline
> integrity check.I can have the image files in the nfs-share archived
> live to another partition that is not mounted.Will I be able to
> perform the integrity check at the block level in this case?Each time
> virtual machine boots up,I need to be able to verify if the image was
> the same as previous boot.> Is this achievable?
> 
> Will these steps work?
> 1. Image file (VM1 - Virtual hard disk file mounted in nfs share partition). 
> 2.I rsync the directory of nfs-share to another partition.
> 3.Then whether I will be able to tell whether the virtual image file has been altered/changed from the previous boot?

I am not sure if I understand what you are trying to do here but if it
is file image (full device image shared on nfs) why not use simple gpg
file signature and verify it before the VM boot?

...
 
> Also I dont get the notion "Dm-verity was designed to provide verification of (read-only) device (to provide verified boot path), all IOs must go through dm-verity."

The dm-verity was designed for ChromeOS for verified boot, IOW it verifies
blocks on underlying block device on-the-fly (when system reads them through
verity mapped device).
This means, that the dm-verity must be underlying device for all read
operations (to allow it stop reads once it detect wrong hash).

I know documentation is terse but at least something is here
http://code.google.com/p/cryptsetup/wiki/DMVerity (see Theory of operation).

Milan

  parent reply	other threads:[~2014-04-06  7:44 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-04-04 21:34 [dm-crypt] verity setup on active device Shiva
2014-04-05 18:39 ` Milan Broz
2014-04-05 22:11   ` Shivaramakrishnan Vaidyanathan
2014-04-05 22:26     ` Shivaramakrishnan Vaidyanathan
2014-04-06  7:53       ` Milan Broz
2014-04-06 23:13         ` Shivaramakrishnan Vaidyanathan
2014-04-06  7:44     ` Milan Broz [this message]
2014-04-07  3:11       ` Shivaramakrishnan Vaidyanathan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=534105C6.3060305@gmail.com \
    --to=gmazyland@gmail.com \
    --cc=dm-crypt@saout.de \
    --cc=shivaramakrishnan740@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.