From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id C71DAAC79; Fri, 26 Jun 2026 15:15:10 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 413C4AC68; Fri, 26 Jun 2026 15:15:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_MISSING,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from fhigh-b8-smtp.messagingengine.com (fhigh-b8-smtp.messagingengine.com [202.12.124.159]) by atuin.qyliss.net (Postfix) with ESMTPS id 5FB45AC66 for ; Fri, 26 Jun 2026 15:15:07 +0000 (UTC) Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.stl.internal (Postfix) with ESMTP id E33BC7A017D; Fri, 26 Jun 2026 11:15:05 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Fri, 26 Jun 2026 11:15:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alyssa.is; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1782486905; x=1782573305; bh=5vZ6Akw3PP NY9VVGhVlYbVQnBc+WETgpFjZpiev58UI=; b=dvWDJsfXgg/lul0aVR/tJpUDDD aLKeQTaB5KUWh7SH83ueHW40c7mGcNsp95gpHQNvRmhAzDgt272uwQOb9XJo8gtq PrPr7vG16khLGOoyVLF9FQ9ZDy+KRA9oKi8kAAzK4hDPJf5VgNADK4wEwaTOyh7A ZILdbR80hskyEmmGMADMNCqzNYswYtO7Vgkwjnoq4edNT/iq89y/pxnhGlyxMQsr 0g4HSdOmQv50On0ggG8wR73PKlAS3XmfXqTXnj/ekr0vkGB+kNVD/DDKg7DIE1R5 jJNEXTgjXa7AU2ZTdHezt/CaU2/SnBe7wfDpADh5ROkqOwwrB/ItN4ZghsXQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t= 1782486905; x=1782573305; bh=5vZ6Akw3PPNY9VVGhVlYbVQnBc+WETgpFjZ piev58UI=; b=SIGxmOJ32BgtyuIViiNMsAoASH40hgr3snlOsORF8DJ9QB0SvAb fFggfC2KYnnmV2A+Aqp4aUdq4XjWEPXEKKWGYTNZQ4Iy2A/UUtDIHQYxvYi6vn9I 9x3dUqYvyb3jSpNZx5JUxKPOQzSWXfe6SmrgtamYu5mhvSAC8/DK3N20mbYazJgt Ps0jFhH5xULaDsIiykAvkBo57c7zGnNfi2gTzQoQ+1nu/XTU19rn65rhG4KJR0F+ 8HGhvQ2sIPux5bTq71ptkE7WQwQJ8kAPxXpwxC6mXj/3p8hs8b+sTvSeDc3Wl/gH ltPsW09YV4/HqD9SC2wzPmpHAhtDcgFVAHA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGgOmWF4SJwHwD+UwJLQE6UrLc0o0cGcDN9MHA+bEIL8et5N/kgGA37afJVdXZSgD PeCQYm1S6I9sGlVuJWUUSx6DUP1hAetx9jnrJ88d8IY9J5gLuq8pBtDjD4lz1aNMeT8h+D URV5lVVUF/i9guAB5FWctUG+OtADXLT0oi4/tDxUURKWfpzcp8AAqZQBGTvTawOK1G9Yqt mRNO6O+ZM7HB6eYTEEjAM+acfGIlKP9xUDaiUSLX/2haZ+1W/LavAsx3B7pbH4jucJhhmJ Bw1vnfe8vZ8exFgAsYsOewaLEOQhztFWpaUHlbdTQAZS99ppO7dXE2K2oqsyit2BWuAJDX ETCqFfkQVxydOwkjzSZZaQcslfmBv12rbo8X9g+yOOTFcMRShFl2r/+k1U06Lu1JeG95VT eP5wolXOSHD2vtg+Y+gbk0cJYw1egAcQoIPQgdNSWiFD9vhzr9sb6e1RKFHxYE4F4cx0Bf qdF0yQ39mgcC9jeptqm4KN40K5ihc69YM29NE6a8cgFyD9yShNefy2RX0/S/liuh/VupjS zBQOWXI+18IW7lxQsN/eqsoEZ+hr+tE4InJydRvdEncvYxe+d+oBIv4uzkF0iu4rdCYyMH 9NtTQHXr3d5aefivMfMLyAq6UdBeXkM5JVKeXciCpOZ0EWEIJ6SWoPPNNMMQ X-ME-Proxy: Feedback-ID: i12284293:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 26 Jun 2026 11:15:04 -0400 (EDT) Received: by fw12.qyliss.net (Postfix, from userid 1000) id 5CE6AB9B5357; Fri, 26 Jun 2026 17:14:59 +0200 (CEST) From: Alyssa Ross To: colbyt Subject: Re: [PATCH 0/5] vm: boot sub-VMs from dm-verity roots and enable IPE In-Reply-To: <20260625202013.1417254-1-colby@colbyt.com> References: <20260625202013.1417254-1-colby@colbyt.com> Date: Fri, 26 Jun 2026 17:14:56 +0200 Message-ID: <87cxxdz633.fsf@alyssa.is> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: RMCGHMKDMPK433U2NY2HARFPCBNFJ3YK X-Message-ID-Hash: RMCGHMKDMPK433U2NY2HARFPCBNFJ3YK X-MailFrom: hi@alyssa.is X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: devel@spectrum-os.org X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable colbyt writes: > This series changes the app VM and net VM root images to boot through > dm-verity, then enables IPE kernel support for the sub-VMs and the > Spectrum host rootfs. > > Each sub-VM disk now has a verity metadata partition and an EROFS root > partition. The build installs the root hash next to the disk image, and > the VM boot paths pass that hash to a shared initramfs. The initramfs > uses the hash to find both partitions, opens /dev/mapper/root-verity, and > switches into it read-only. > > The last two patches only enable kernel support for IPE. They do not > install an IPE policy. With the existing generated kernel config, > enabling SECURITY_IPE also enables the dm-verity root-hash provider, so > later policy work can match files from verified roots. Would you mind explaining your motivation / the direction you envisage here in a bit more detail? Given that the VM gets its root file system and the corresponding verity hash from the same place (the host file system), there's no immediate security benefit from using dm-verity, right? Is the idea rather to enable some sort of cool IPE thing for which dm-verity is a requirement, but that's not implemented yet as part of this series? (I really appreciate the quality of your patches BTW =E2=80=94 you've obvio= usly gone to some effort to identify and follow all the tiny little conventions we have in the codebase. Thank you!) --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQGoGac7QfI+H5ZtFCZddwkt31pFQUCaj6XcAAKCRCZddwkt31p Fd8JAQCtU5/ASfSPH+AYgzzAhHm/kYiVOgc1tA2X2oreI+ODwgD+JdzTvpn32gCs 23qaUDFBsv/pDqfbY/R/Qdf0Dli1Pgk= =7cjo -----END PGP SIGNATURE----- --=-=-=--