4 ms·

dm-verity mainly https://coreos.com/blog/verifying-os-at-runtime.html https://coreos.com/blog/verifying-os-at-runtime.html

• cmurf 7y ago
  Bit more on dm-verity as it relates to appliance and non-appliance systems. https://blog.verbum.org/2017/06/12/on-dm-verity-and-operating-systems/ https://blog.verbum.org/2017/06/12/on-dm-verity-and-operatin... Btrfs will support cryptographically secure hash algorithms (sha256 and blake2) starting with kernel 5.5. I wonder if this is a suitable compromise over dm-verity, which can't be updated, and more conventional file system options? When I consider various use cases, Btrfs always results in EIO rather than propagating bad data to user space; compress=zstd:1 reduces writes, saves storage space, and can improve performance of slower storage. There's also two interesting read-only options: read-only snapshots and read-only volume (via the seed flag), root can't write to either. Root would need to unset the flag first. A read-only seed can support writes via a volatile 2nd device, e.g. /dev/zram device, reboot and you get a reset. Or persistence via a partition. Either way a reset also resets filesystem state.