diff options
| author | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-06-02 15:35:58 +0100 |
|---|---|---|
| committer | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-06-25 08:45:21 +0100 |
| commit | c2923fdcd771e1e6470a6c67c23d4b21f536e7f6 (patch) | |
| tree | 01a93f97d2aa6f5ac510876b4c322d4c3927b767 /README | |
| parent | 035e8e50d73a0e5427149bbe50a426dd84ece178 (diff) | |
| download | systemd-c2923fdcd771e1e6470a6c67c23d4b21f536e7f6.tar.gz | |
dissect/nspawn: add support for dm-verity root hash signature
Since cryptsetup 2.3.0 a new API to verify dm-verity volumes by a
pkcs7 signature, with the public key in the kernel keyring,
is available. Use it if libcryptsetup supports it.
Diffstat (limited to 'README')
| -rw-r--r-- | README | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -35,6 +35,7 @@ LICENSE: REQUIREMENTS: Linux kernel >= 3.13 Linux kernel >= 4.2 for unified cgroup hierarchy support + Linux kernel >= 5.4 for signed Verity images support Kernel Config Options: CONFIG_DEVTMPFS @@ -102,6 +103,9 @@ REQUIREMENTS: CONFIG_EFIVAR_FS CONFIG_EFI_PARTITION + Required for signed Verity images support: + CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG + We recommend to turn off Real-Time group scheduling in the kernel when using systemd. RT group scheduling effectively makes RT scheduling unavailable for most userspace, since it @@ -144,7 +148,7 @@ REQUIREMENTS: libblkid >= 2.24 (from util-linux) (optional) libkmod >= 15 (optional) PAM >= 1.1.2 (optional) - libcryptsetup (optional) + libcryptsetup (optional), >= 2.3.0 required for signed Verity images support libaudit (optional) libacl (optional) libselinux (optional) |