dissect: condition usespace verity keyring via kernel cmdline option + env var

2024-02-28 16:18:22 +01:00
parent f4a63ce25f
commit f0ecff8506
3 changed files with 40 additions and 1 deletions
@@ -488,6 +488,12 @@ disk images with `--image=` or similar:
  devices when opening them. Defaults to on, set this to "0" to disable this
  feature.

+* `$SYSTEMD_ALLOW_USERSPACE_VERITY` — takes a boolean, which controls whether
+  to consider the userspace Verity public key store in `/etc/verity.d/` (and
+  related directories) to authenticate signatures on Verity hashes of disk
+  images. Defaults to true, i.e. userspace signature validation is allowed. If
+  false, authentication can be done only via the kernel's internal keyring.
+
 `systemd-cryptsetup`:

 * `$SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE` – takes a boolean, which controls