Bug 11072

Summary: integrity protection
Product: [Yocto Project Subprojects] IoT Reference OS Kit Reporter: Patrick Ohly <patrick.ohly>
Component: intel-iot-refkit-securityAssignee: Patrick Ohly <patrick.ohly>
Status: RESOLVED FIXED QA Contact:
Severity: enhancement    
Priority: Medium CC: matti-pekka.sivosuo, mikko.ylinen
Version: unspecified   
Target Milestone: 2.3 M4   
Hardware: x86   
OS: x86_64   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)
Bug Depends on: 11070, 11276    
Bug Blocks: 11206    

Description Patrick Ohly 2017-02-17 13:44:50 UTC 
It must be possible to install and update a device so that the rootfs is protected against offline attacks. Being able to store locally modified files (/etc, /var, /home) in the rootfs partition is desirable but might not be a hard requirement. Atomic updates are important.

Two solutions are initially targeted:
* dm-verity (this item), initially limited to the installer image
* whole-disk encryption (bug #11070)
Comment 1 Patrick Ohly 2017-03-03 16:52:35 UTC 
Missing: automated tests, documentation
Comment 2 Patrick Ohly 2017-03-31 10:13:56 UTC 
See https://github.com/intel/intel-iot-refkit/pull/97 for the code, documentation and tests under review at the moment.
Comment 3 Mikko Ylinen 2017-04-18 13:07:53 UTC 
Resolving on behalf of Patrick.