Add an option to dm-verity to validate hashes at most once
Subsystems (2)
PATCH v2 1/1 Add an option to dm-verity to validate hashes at most once
Add an option to dm-verity to validate hashes at most once to allow platforms that is CPU/memory contraint to be protected by dm-verity against offline attacks.
The option introduces a bitset that is used to check if a block has been validated before or not. A block can be validated more than once as there is no thread protection for the bitset.
This patch has been developed and tested on entry-level Android Go devices.
Signed-off-by Patrik Torstensson <[email protected]>
---
Changes since version 1:
- added documentation about the new option
- added the new option into DM_TABLE_STATUS ioctl
- replaced 'io->block + b' with 'cur_block'
- increase minor version
Documentation/device-mapper/verity.txt | 11 +++++ drivers/md/dm-verity-target.c | 66 ++++++++++++++++++++++++-- drivers/md/dm-verity.h | 1 + 3 files changed, 73 insertions(+), 5 deletions(-)
Documentation/device-mapper/verity.txt +11 -0
@@ -109,6 +109,17 @@ fec_start <offset> This is the offset, in <data_block_size> blocks, from the start of the FEC device to the beginning of the encoding data. +check_at_most_once + Verify data blocks only the first time they are read from the data device, + rather than every time. This reduces the overhead of dm-verity so that it + can be used on systems that are memory and/or CPU constrained. However, it + provides a reduced level of security because only offline tampering of the + data device's content will be detected, not online tampering. + + Hash blocks are still verified each time they are read from the hash device, + since verification of hash blocks is less performance critical than data + blocks, and a hash block will not be verified any more after all the data + blocks it covers have been verified anyway. Theory of operation ===================
drivers/md/dm-verity-target.c +61 -5
132 lines not on this page · raw message
drivers/md/dm-verity.h +1 -0
@@ -63,6 +63,7 @@ struct dm_verity {sector_t hash_level_block[DM_VERITY_MAX_LEVELS ];struct dm_verity_fec *fec;/* forward error correction */ +unsigned long *validated_blocks;/* bitset blocks validated */ };struct dm_verity_io {
Signature · 1 line
2.17.0.rc0.231.g781580f067-goog