diff options
| author | Lennart Poettering <lennart@poettering.net> | 2020-06-09 19:52:21 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-06-09 19:52:21 +0200 |
| commit | 4f4f37b20d0598d424ff9187112cd791d325ac50 (patch) | |
| tree | 419f4639148f7c1ff8e6597af8ff26624dcd6580 /man | |
| parent | 2233c2703c91325f8c742daf2d37c1343f35998e (diff) | |
| parent | e7cbe5cb9e7d246474dcee1d8e759ed3c8786913 (diff) | |
| download | systemd-4f4f37b20d0598d424ff9187112cd791d325ac50.tar.gz | |
Merge pull request #16046 from bluca/dissect_squashfs_verity
dissect: single-filesystem verity images with external hashdevice
Diffstat (limited to 'man')
| -rw-r--r-- | man/systemd-nspawn.xml | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index f9cc5a8828..72d2f1e4ba 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -302,6 +302,10 @@ hash partitions are set up if the root hash for them is specified using the <option>--root-hash=</option> option.</para> + <para>Single file system images (i.e. file systems without a surrounding partition table) can be opened using + dm-verity if the integrity data is passed using the <option>--root-hash=</option> and + <option>--verity-data=</option> options.</para> + <para>Any other partitions, such as foreign partitions or swap partitions are not mounted. May not be specified together with <option>--directory=</option>, <option>--template=</option>.</para></listitem> </varlistentry> @@ -390,8 +394,20 @@ project='man-pages'><refentrytitle>xattr</refentrytitle><manvolnum>7</manvolnum></citerefentry>), then the root hash is read from it, also as formatted hexadecimal characters. If the extended file attribute is not found (or is not supported by the underlying file system), but a file with the <filename>.roothash</filename> suffix is - found next to the image file, bearing otherwise the same name, the root hash is read from it and automatically - used, also as formatted hexadecimal characters.</para></listitem> + found next to the image file, bearing otherwise the same name (except if the image has the + <filename>.raw</filename> suffix, in which case the root hash file must not have it in its name), the root hash + is read from it and automatically used, also as formatted hexadecimal characters.</para></listitem> + </varlistentry> + + <varlistentry> + <term><option>--verity-data=</option></term> + + <listitem><para>Takes the path to a data integrity (dm-verity) file. This option enables data integrity checks + using dm-verity, if a root-hash is passed and if the used image itself does not contains the integrity data. + The integrity data must be matched by the root hash. If this option is not specified, but a file with the + <filename>.verity</filename> suffix is found next to the image file, bearing otherwise the same name (except if + the image has the <filename>.raw</filename> suffix, in which case the verity data file must not have it in its name), + the verity data is read from it and automatically used.</para></listitem> </varlistentry> <varlistentry> |