From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qa0-x233.google.com (mail-qa0-x233.google.com [IPv6:2607:f8b0:400d:c00::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mail.saout.de (Postfix) with ESMTPS for ; Sun, 6 Apr 2014 00:26:20 +0200 (CEST) Received: by mail-qa0-f51.google.com with SMTP id j7so4580815qaq.10 for ; Sat, 05 Apr 2014 15:26:19 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <53404DD9.2020101@gmail.com> Date: Sat, 5 Apr 2014 18:26:18 -0400 Message-ID: From: Shivaramakrishnan Vaidyanathan Content-Type: multipart/alternative; boundary=001a113b59908e7ff404f6531f5c Subject: Re: [dm-crypt] verity setup on active device. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Milan Broz Cc: dm-crypt@saout.de --001a113b59908e7ff404f6531f5c Content-Type: text/plain; charset=ISO-8859-1 Also, http://lwn.net/Articles/533558/ tells that "The key advantage over dm-verity is that the target supports read-write and requires less hash calculation operations.Device-mapper "integrity" target provides transparent cryptographic integrity protection of underlying read-write block device using hash-based message authentication codes (HMACs), which can be stored on the same or different block device." I dont understand or get the main purpose of this tool. Could you please explain in a bit more elaborate way.Thanks On Sat, Apr 5, 2014 at 6:11 PM, Shivaramakrishnan Vaidyanathan < shivaramakrishnan740@gmail.com> wrote: > Thanks Milan for your reply. > I have few questions is this regard.I am ready to perform the offline > integrity check.I can have the image files in the nfs-share archived live > to another partition that is not mounted.Will I be able to perform the > integrity check at the block level in this case?Each time virtual machine > boots up,I need to be able to verify if the image was the same as previous > boot. > Is this achievable? > > Will these steps work? > 1. Image file (VM1 - Virtual hard disk file mounted in nfs share > partition). > 2.I rsync the directory of nfs-share to another partition. > 3.Then whether I will be able to tell whether the virtual image file has > been altered/changed from the previous boot? > > Can you please provide some details in regard to the implementations > required in this case? > > If you know any other alternatives,It would be great if you could share > it.Also I dont get the notion "Dm-verity was designed to provide verification > of (read-only) device (to provide verified boot path), all IOs must go > through dm-verity." > > So what does this mean? > > > On Sat, Apr 5, 2014 at 2:39 PM, Milan Broz wrote: > >> On 04/04/2014 11:34 PM, Shiva wrote: >> ... >> > 5.Used the root hash in this command. >> > veritysetup --debug create nfs /dev/sdb /dev/sdc "root hash" >> > >> > Everything works well. >> > My problem is I am not able to perform step5 for a mounted partition. >> > >> > I require a mounted partition since nfs-share will use this partition. >> > (For addition and deletion) >> > >> > Is there a command switch that needs to be performed in order to >> achieve this? >> >> I am afraid this is not possible. Dm-verity was designed to provide >> verification of (read-only) device (to provide verified boot path), >> all IOs must go through dm-verity. >> (So it must be in the stack from the beginning). >> >> You cannot just add it later or run it parallel with mounted partition. >> And how this can work if some data are already in page/fs cache? >> >> Milan >> > > --001a113b59908e7ff404f6531f5c Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Also,
=A0"The key advantage over dm-verity is that the target s= upports read-write and=A0requires l= ess hash calculation operations.Dev= ice-mapper "integrity" target provides transparent cryptographic = integrity=A0protection of underlyin= g read-write block device using hash-based message=A0authentication codes (HMACs), which can be stored on the = same or different=A0block device.&q= uot;

I dont understand or get the main purpose of this tool. C= ould you please explain in a bit more elaborate way.Thanks



On Sat, Apr 5, 2014 at 6:11 PM, = Shivaramakrishnan Vaidyanathan <shivaramakrishnan740@gmail.co= m> wrote:
Thanks Milan for your reply= .=A0
I have few questions is this regard.I am ready to perform the offl= ine integrity check.I can have the image files in the nfs-share archived li= ve to another partition that is not mounted.Will I be able to perform the i= ntegrity check at the block level in this case?Each time virtual machine bo= ots up,I need to be able to verify if the image was the same as previous bo= ot.
Is this achievable?

Will these steps work?
1. Image file (VM1 - Virtual hard disk file mounted in nfs share pa= rtition).=A0
2.I rsync the directory of nfs-share to another part= ition.
3.Then whether I will be able to tell whether the virtual image file h= as been altered/changed from the previous boot?

Ca= n you please provide some details in regard to the implementations required= in this case?

If you know any other alternatives,It would be great if= you could share it.Also I dont get the notion "Dm-verity was designed to provide=A0<= /span>verificat= ion of (read-only) device (to provide verified boot path),=A0all IOs must go throug= h dm-verity."

So = what does this mean?


On Sat, Apr 5, 2014 at 2:39 PM, Milan Broz <gmazyland@gmail.com><= /span> wrote:
On 04/04/2014 11:34 PM, Shiva wrote:
...
> 5.Used the root hash in this command.
> veritysetup --debug create nfs /dev/sdb /dev/sdc "root hash"=
>
> Everything works well.
> My problem is I am not able to perform step5 for a mounted partition.<= br> >
> I require a mounted partition since nfs-share will use this partition.=
> (For addition and deletion)
>
> Is there a command switch that needs to be performed in order to achie= ve this?

I am afraid this is not possible. Dm-verity was designed to provide
verification of (read-only) device (to provide verified boot path),
all IOs must go through dm-verity.
(So it must be in the stack from the beginning).

You cannot just add it later or run it parallel with mounted partition.
And how this can work if some data are already in page/fs cache?

Milan


--001a113b59908e7ff404f6531f5c--