Re: [PATCH] dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE

[Ayoub Zaki <ayoub.zaki@embetrix.com>]

Hi,


On 9/21/26 11:46, Mikulas Patocka wrote:
> Hi
> 
> The argument can be turned off even with your patch - by specifying
> dm_verity.require_signatures=0 on the kernel command line (read-only
> module parameters can be modified on the command line during boot).
> 
> I'd like to know what kind of security problem does this patch try to
> solve. If the attacker can tamper with the kernel command line, he can
> already gain root (i.e. by using init=/bin/bash).
> 
> Mikulas

Thanks for reviewing.
I should have highlighted the change to bool_enable_only: with 
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE=y it rejects attempts to 
clear require_signatures, including from the command line.
I followed the existing CONFIG_MODULE_SIG_FORCE and module.sig_enforce 
implementation.
My intention is to make signature enforcement a build-time policy rather 
than depend on boot configuration.
I fully agree with your point and that this patch alone does not protect 
against arbitrary command-line tampering.

If required I can clarify the scope in a v2 ?

> 
> 
> On Mon, 7 Sep 2026, Ayoub Zaki wrote:
> 
>> Add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE Kconfig option.  When enabled,
>> dm-verity always requires a valid root hash signature: require_signatures
>> defaults to true and can no longer be cleared on the command line.  When
>> disabled, the existing require_signatures module parameter controls
>> enforcement.
>>
>> Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
>> ---
>>   Documentation/admin-guide/device-mapper/verity.rst |  5 +++++
>>   drivers/md/Kconfig                                 | 14 ++++++++++++++
>>   drivers/md/dm-verity-verify-sig.c                  |  4 ++--
>>   3 files changed, 21 insertions(+), 2 deletions(-)
>>
>> diff --git a/Documentation/admin-guide/device-mapper/verity.rst b/Documentation/admin-guide/device-mapper/verity.rst
>> index eb9475d7e196..bb48c001aeac 100644
>> --- a/Documentation/admin-guide/device-mapper/verity.rst
>> +++ b/Documentation/admin-guide/device-mapper/verity.rst
>> @@ -163,6 +163,11 @@ root_hash_sig_key_desc <key_description>
>>       also gain new certificates at run time if they are signed by a certificate
>>       already in the secondary trusted keyring.
>>   
>> +    Whether a signature is required for every dm-verity device is controlled by
>> +    the dm_verity.require_signatures parameter which defaults to off. Setting
>> +    DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE makes it default to on in which case it
>> +    can no longer be turned off.
>> +
>>   try_verify_in_tasklet
>>       If verity hashes are in cache and the IO size does not exceed the limit,
>>       verify data blocks in bottom half instead of workqueue. This option can
>> diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
>> index df27c7d066d2..59098d1f4534 100644
>> --- a/drivers/md/Kconfig
>> +++ b/drivers/md/Kconfig
>> @@ -610,6 +610,20 @@ config DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING
>>   
>>   	  If unsure, say N.
>>   
>> +config DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
>> +	bool "Require dm-verity root hash signature verification"
>> +	depends on DM_VERITY_VERIFY_ROOTHASH_SIG
>> +	help
>> +	  Reject dm-verity devices that are created without a valid root hash
>> +	  signature.  Without this, whether a signature is required is decided
>> +	  at boot time by the dm_verity.require_signatures parameter which
>> +	  defaults to off.
>> +
>> +	  Enabling this makes that parameter default to on and it can then no
>> +	  longer be turned off.
>> +
>> +	  If unsure, say N.
>> +
>>   config DM_VERITY_FEC
>>   	bool "Verity forward error correction support"
>>   	depends on DM_VERITY
>> diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
>> index b2b55c41e2cb..aadcf5e4a47c 100644
>> --- a/drivers/md/dm-verity-verify-sig.c
>> +++ b/drivers/md/dm-verity-verify-sig.c
>> @@ -21,8 +21,8 @@ static bool dm_verity_keyring_unsealed __ro_after_init;
>>   module_param_named(keyring_unsealed, dm_verity_keyring_unsealed, bool, 0444);
>>   MODULE_PARM_DESC(keyring_unsealed, "Leave the dm-verity keyring unsealed");
>>   
>> -static bool require_signatures;
>> -module_param(require_signatures, bool, 0444);
>> +static bool require_signatures = IS_ENABLED(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE);
>> +module_param(require_signatures, bool_enable_only, 0444);
>>   MODULE_PARM_DESC(require_signatures,
>>   		"Verify the roothash of dm-verity hash tree");
>>   
>>
>> base-commit: df2908090cda368b01ff43709f51890076c56157
>> -- 
>> 2.43.0
>>
> 

Mit freundlichen Grüßen / Kind regards

-- 
Ayoub Zaki
Embedded Systems Consultant

Vaihinger Straße 2/1
D-71634 Ludwigsburg

Email    : ayoub.zaki@embetrix.com
Homepage : https://embetrix.com