A possible step toward integrity measurement for Fedora
A possible step toward integrity measurement for Fedora
Posted Jan 11, 2021 16:29 UTC (Mon) by walters (subscriber, #7396)In reply to: A possible step toward integrity measurement for Fedora by hkario
Parent article: A possible step toward integrity measurement for Fedora
No; fs-verity makes executables read-only, not a complete filesystem. You're thinking of dm-verity perhaps?
Note that with fs-verity even a "read-only" executable can be `unlink()`ed and a new one written in its place; this is why the docs https://www.kernel.org/doc/html/latest/filesystems/fsveri... talk about ensuring that the verity state of a file is validated by something (userspace, or basic support for automatic kernel verification).
