Re: [PATCH] dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE

[Mikulas Patocka]

Hi

The argument can be turned off even with your patch - by specifying 
dm_verity.require_signatures=0 on the kernel command line (read-only 
module parameters can be modified on the command line during boot).

I'd like to know what kind of security problem does this patch try to 
solve. If the attacker can tamper with the kernel command line, he can 
already gain root (i.e. by using init=/bin/bash).

Mikulas


On Mon, 7 Sep 2026, Ayoub Zaki wrote:

> Add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE Kconfig option.  When enabled,
> dm-verity always requires a valid root hash signature: require_signatures
> defaults to true and can no longer be cleared on the command line.  When
> disabled, the existing require_signatures module parameter controls
> enforcement.
> 
> Signed-off-by: Ayoub Zaki <ayoub.zaki@xxxxxxxxxxxx>
> ---
>  Documentation/admin-guide/device-mapper/verity.rst |  5 +++++
>  drivers/md/Kconfig                                 | 14 ++++++++++++++
>  drivers/md/dm-verity-verify-sig.c                  |  4 ++--
>  3 files changed, 21 insertions(+), 2 deletions(-)
> 
> diff --git a/Documentation/admin-guide/device-mapper/verity.rst b/Documentation/admin-guide/device-mapper/verity.rst
> index eb9475d7e196..bb48c001aeac 100644
> --- a/Documentation/admin-guide/device-mapper/verity.rst
> +++ b/Documentation/admin-guide/device-mapper/verity.rst
> @@ -163,6 +163,11 @@ root_hash_sig_key_desc <key_description>
>      also gain new certificates at run time if they are signed by a certificate
>      already in the secondary trusted keyring.
>  
> +    Whether a signature is required for every dm-verity device is controlled by
> +    the dm_verity.require_signatures parameter which defaults to off. Setting
> +    DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE makes it default to on in which case it
> +    can no longer be turned off.
> +
>  try_verify_in_tasklet
>      If verity hashes are in cache and the IO size does not exceed the limit,
>      verify data blocks in bottom half instead of workqueue. This option can
> diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
> index df27c7d066d2..59098d1f4534 100644
> --- a/drivers/md/Kconfig
> +++ b/drivers/md/Kconfig
> @@ -610,6 +610,20 @@ config DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING
>  
>  	  If unsure, say N.
>  
> +config DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
> +	bool "Require dm-verity root hash signature verification"
> +	depends on DM_VERITY_VERIFY_ROOTHASH_SIG
> +	help
> +	  Reject dm-verity devices that are created without a valid root hash
> +	  signature.  Without this, whether a signature is required is decided
> +	  at boot time by the dm_verity.require_signatures parameter which
> +	  defaults to off.
> +
> +	  Enabling this makes that parameter default to on and it can then no
> +	  longer be turned off.
> +
> +	  If unsure, say N.
> +
>  config DM_VERITY_FEC
>  	bool "Verity forward error correction support"
>  	depends on DM_VERITY
> diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
> index b2b55c41e2cb..aadcf5e4a47c 100644
> --- a/drivers/md/dm-verity-verify-sig.c
> +++ b/drivers/md/dm-verity-verify-sig.c
> @@ -21,8 +21,8 @@ static bool dm_verity_keyring_unsealed __ro_after_init;
>  module_param_named(keyring_unsealed, dm_verity_keyring_unsealed, bool, 0444);
>  MODULE_PARM_DESC(keyring_unsealed, "Leave the dm-verity keyring unsealed");
>  
> -static bool require_signatures;
> -module_param(require_signatures, bool, 0444);
> +static bool require_signatures = IS_ENABLED(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE);
> +module_param(require_signatures, bool_enable_only, 0444);
>  MODULE_PARM_DESC(require_signatures,
>  		"Verify the roothash of dm-verity hash tree");
>  
> 
> base-commit: df2908090cda368b01ff43709f51890076c56157
> -- 
> 2.43.0
>