dm-verity root hash is not trusted

Open
#10 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
32/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
cpp
Domain
operating-systems, security

Research direction

Start with the oem veritysetup and oem verityappend entry points and compare their behavior with the referenced AOSP dm-verity signing workflow. Done means the roothash is signed during provisioning, verified at boot with the kernel builtin key, and the key-management workflow is documented.

Written by the indexing model from the issue text.

Description

oem veritysetup / oem verityappend generate and store a dm-verity root hash but nothing signs it. Integrity is checked but authenticity isn't : swap in a valid hash tree over a tampered rootfs and the kernel happily mounts it!

=> Breaks the chain of trust for any deployment that cares about authenticity, not just integrity.

suggested fix

  • Sign the roothash during provisioning
  • Verify it on boot (kernel builtin key)
  • Document the key management workflow

reference: AOSP dm-verity signing

Dominant language
C++
Stars
8
Forks
2
Avg merge
1d 6h
Merged PRs (30d)
4

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from raspberrypi/rpi-fastbootd

All issues in raspberrypi/rpi-fastbootd

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.