summaryrefslogtreecommitdiff
path: root/src/machine/image-dbus.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-12-07 18:28:13 +0100
committerLennart Poettering <lennart@poettering.net>2016-12-07 18:38:41 +0100
commit4623e8e6ac7c7a36b16ec2dc9ad8507fd820c9fa (patch)
tree38e370801554adb34fdcfd72ee79e3b915991334 /src/machine/image-dbus.c
parent4827ab4854d3107d05b65194ac72729955fb3585 (diff)
nspawn/dissect: automatically discover dm-verity verity partitions
This adds support for discovering and making use of properly tagged dm-verity data integrity partitions. This extends both systemd-nspawn and systemd-dissect with a new --root-hash= switch that takes the root hash to use for the root partition, and is otherwise fully automatic. Verity partitions are discovered automatically by GPT table type UUIDs, as listed in https://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ (which I updated prior to this change, to include new UUIDs for this purpose. mkosi with https://github.com/systemd/mkosi/pull/39 applied may generate images that carry the necessary integrity data. With that PR and this commit, the following simply lines suffice to boot up an integrity-protected container image: ``` # mkdir test # cd test # mkosi --verity # systemd-nspawn -i ./image.raw -bn ``` Note that mkosi writes the image file to "image.raw" next to a a file "image.roothash" that contains the root hash. systemd-nspawn will look for that file and use it if it exists, in case --root-hash= is not specified explicitly.
Diffstat (limited to 'src/machine/image-dbus.c')
-rw-r--r--src/machine/image-dbus.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/machine/image-dbus.c b/src/machine/image-dbus.c
index 65953b368f..e2fb882393 100644
--- a/src/machine/image-dbus.c
+++ b/src/machine/image-dbus.c
@@ -336,7 +336,7 @@ static int raw_image_get_os_release(Image *image, char ***ret, sd_bus_error *err
if (r < 0)
return sd_bus_error_set_errnof(error, r, "Failed to set up loop block device for %s: %m", image->path);
- r = dissect_image(d->fd, &m);
+ r = dissect_image(d->fd, NULL, 0, &m);
if (r == -ENOPKG)
return sd_bus_error_set_errnof(error, r, "Disk image %s not understood: %m", image->path);
if (r < 0)