I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it can be used to help verification of kernel eg. - can this mechanism be used on typical PC (server precisely) which frequently updates kernel and performs rw on basically whole storage? How would it work then? I mean lets say that something messed with fs without booting OS - is there anything that would protect anyone from being able to just recalculate all hashes, replace keys, alter kernel image to make everything look "legit"?


You must log in to answer this question.

Browse other questions tagged .