mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
4da8f8c8a1
Add a new configuration DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING to enable dm-verity signatures to be verified against the secondary trusted keyring. Instead of relying on the builtin trusted keyring (with hard-coded certificates), the second trusted keyring can include certificate authorities from the builtin trusted keyring and child certificates loaded at run time. Using the secondary trusted keyring enables to use dm-verity disks (e.g. loop devices) signed by keys which did not exist at kernel build time, leveraging the certificate chain of trust model. In practice, this makes it possible to update certificates without kernel update and reboot, aligning with module and kernel (kexec) signature verification which already use the secondary trusted keyring. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> |
||
|---|---|---|
| .. | ||
| cache-policies.rst | ||
| cache.rst | ||
| delay.rst | ||
| dm-clone.rst | ||
| dm-crypt.rst | ||
| dm-dust.rst | ||
| dm-ebs.rst | ||
| dm-flakey.rst | ||
| dm-init.rst | ||
| dm-integrity.rst | ||
| dm-io.rst | ||
| dm-log.rst | ||
| dm-queue-length.rst | ||
| dm-raid.rst | ||
| dm-service-time.rst | ||
| dm-uevent.rst | ||
| dm-zoned.rst | ||
| era.rst | ||
| index.rst | ||
| kcopyd.rst | ||
| linear.rst | ||
| log-writes.rst | ||
| persistent-data.rst | ||
| snapshot.rst | ||
| statistics.rst | ||
| striped.rst | ||
| switch.rst | ||
| thin-provisioning.rst | ||
| unstriped.rst | ||
| verity.rst | ||
| writecache.rst | ||
| zero.rst | ||