admin-guide/device-mapper/verity.rst

2 dm-verity
5 Device-Mapper's "verity" target provides transparent integrity checking of
7 This target is read-only.
21     This is the type of the on-disk hash format.
40     dm-verity device.
55     This is the offset, in <hash_block_size>-blocks, from the start of hash_dev
91     Restart the system when an I/O error is detected.
95     Panic the device when an I/O error is detected. This option is
105     Use forward error correction (FEC) to recover from corruption if hash
119     is M-N.
131     rather than every time.  This reduces the overhead of dm-verity so that it
167 dm-verity is meant to be set up as part of a verified boot path.  This
169 booting from a known-good device (like a USB drive or CD).
171 When a dm-verity device is configured, it is expected that the caller
173 After instantiation, all hashes will be verified on-demand during
179 per-block basis. This allows for a lightweight hash computation on first read
183 If forward error correction (FEC) support is enabled any recovery of
185 corresponding data. This is why combining error correction with
189 ---------
197 selected cryptographic digest algorithm.  The hashes are linearly-ordered in
216 On-disk format
219 The verity kernel code does not read the verity metadata on-disk header.
221 It is expected that a user-space tool will verify the integrity of the
225 be passed via the kernel command-line in a rooted chain of trust where
226 the command-line is verified.
232 The full specification of kernel parameters and on-disk metadata format
246   # dmsetup create vroot --readonly --table \