linux-kernel - Re: Kernel 4.14: Using dm-verity with squashfs rootfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Jul 2021 22:59:33 +0530
From:   Pintu Agarwal <pintu.ping@...il.com>
To:     Mikulas Patocka <mpatocka@...hat.com>
Cc:     open list <linux-kernel@...r.kernel.org>,
        Phillip Lougher <phillip@...ashfs.org.uk>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        linux-mtd <linux-mtd@...ts.infradead.org>, dm-devel@...hat.com,
        Kernelnewbies <kernelnewbies@...nelnewbies.org>, agk@...hat.com,
        snitzer@...hat.com, shli@...nel.org,
        Sami Tolvanen <samitolvanen@...gle.com>
Subject: Re: Kernel 4.14: Using dm-verity with squashfs rootfs - mounting issue

On Wed, 21 Jul 2021 at 22:40, Mikulas Patocka <mpatocka@...hat.com> wrote:

> > >
> > > Try to set up dm-verity with block size 512 bytes.
> > >
> > > I don't know what block size does squashfs use, but if the filesystem
> > > block size is smaller than dm-verity block size, it doesn't work.
> > >
> > Okay thank you so much for this clue,
> > It seems we are using 65536 as the squashfs block size:
>
> 65536 is the compression block size - it is unrelated to I/O block size.
>
> There's a config option SQUASHFS_4K_DEVBLK_SIZE. The documentation says
> that it uses by default 1K block size and if you enable this option, it
> uses 4K block size.
>
Okay it seems this config is set in our case:
CONFIG_SQUASHFS_4K_DEVBLK_SIZE=y
So, with this the squashfs and dm-verity block size exactly matches (4K)

> So, try to set it. Or try to reduce dm-verity block size down to 1K.
>
Okay we are trying this.
Thank you so much!!

Regards,
Pintu