diff options
| author | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-06-08 15:02:55 +0200 |
|---|---|---|
| committer | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-06-25 09:45:21 +0200 |
| commit | d4d55b0d13e9326fccd566789cadf41308c5ddb8 (patch) | |
| tree | 865b0e915586061122949c9ddd774726ebc2cb0e /man/systemd.exec.xml | |
| parent | dissect/nspawn: add support for dm-verity root hash signature (diff) | |
| download | systemd-d4d55b0d13e9326fccd566789cadf41308c5ddb8.tar.xz systemd-d4d55b0d13e9326fccd566789cadf41308c5ddb8.zip | |
core: add RootHashSignature service parameter
Allow to explicitly pass root hash signature as a unit option. Takes precedence
over implicit checks.
Diffstat (limited to 'man/systemd.exec.xml')
| -rw-r--r-- | man/systemd.exec.xml | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index de0cfac2a9..c828109d01 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -165,6 +165,20 @@ </varlistentry> <varlistentry> + <term><varname>RootHashSignature=</varname></term> + + <listitem><para>Takes a PKCS7 formatted binary signature of the <varname>RootHash=</varname> option as a path + to a DER encoded signature file or as an ASCII base64 string encoding of the DER encoded signature, prefixed + by <literal>base64:</literal>. The dm-verity volume will only be opened if the signature of the root hash + signature is valid and created by a public key present in the kernel keyring. If this option is not specified, + but a file with the <filename>.roothash.p7s</filename> suffix is found next to the image file, bearing otherwise + the same name (except if the image has the <filename>.raw</filename> suffix, in which case the signature file + must not have it in its name), the signature is read from it and automatically used.</para> + + <xi:include href="system-only.xml" xpointer="singular"/></listitem> + </varlistentry> + + <varlistentry> <term><varname>RootVerity=</varname></term> <listitem><para>Takes the path to a data integrity (dm-verity) file. This option enables data integrity checks |