dm-verity Root Filesystem Integrity Verification

dm-verity Root Filesystem Integrity Verification An architecture diagram generated by Archify. Root Filesystem · read-only · Architecture component Root Filesystem read-only Read Block · block-level access · dm-verity operation Read Block block-level access Compute Hash · hash of the read block · dm-verity operation Compute Hash hash of the read block Verify Hash · compare with stored hash · dm-verity operation Verify Hash compare with stored hash Allow Access · block returned · dm-verity operation Allow Access block returned Deny Access · tampering detected · dm-verity operation Deny Access tampering detected Merkle Tree · hash store · Architecture component Merkle Tree hash store block stored hash match mismatch dm-verity operation Legend Backend Database Security

Verification flow

  • • A hash is computed on every block read
  • • It is compared with the hash stored in the Merkle Tree

Protection

  • • Root filesystem integrity verified at boot
  • • Runtime modification attempts detected and blocked
  • • Prevents malicious code injection