Bug 11072 - integrity protection
Summary: integrity protection
Status: RESOLVED FIXED
Alias: None
Product: IoT Reference OS Kit
Classification: Yocto Project Subprojects
Component: intel-iot-refkit-security (show other bugs)
Version: unspecified
Hardware: x86 x86_64
: Medium enhancement
Target Milestone: 2.3 M4
Assignee: Patrick Ohly
QA Contact:
URL:
Whiteboard:
Depends on: 11070 11276
Blocks: 11206
  Show dependency tree
 
Reported: 2017-02-17 13:44 UTC by Patrick Ohly
Modified: 2017-04-18 13:07 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick Ohly 2017-02-17 13:44:50 UTC 
It must be possible to install and update a device so that the rootfs is protected against offline attacks. Being able to store locally modified files (/etc, /var, /home) in the rootfs partition is desirable but might not be a hard requirement. Atomic updates are important.

Two solutions are initially targeted:
* dm-verity (this item), initially limited to the installer image
* whole-disk encryption (bug #11070)
Comment 1 Patrick Ohly 2017-03-03 16:52:35 UTC 
Missing: automated tests, documentation
Comment 2 Patrick Ohly 2017-03-31 10:13:56 UTC 
See https://github.com/intel/intel-iot-refkit/pull/97 for the code, documentation and tests under review at the moment.
Comment 3 Mikko Ylinen 2017-04-18 13:07:53 UTC 
Resolving on behalf of Patrick.