dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-10 17:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

man: clarify that /etc/verity.d only parses certificates with the .crt extension

Browse Source 
Exposed in the dracut testsuite while adding tests for sysexts:

```
[    2.972948] localhost (sd-merge)[510]: Validation of dm-verity signature failed via the kernel, trying userspace validation instead: Required key not available
[    2.972993] localhost (sd-merge)[510]: Skipping file '/etc/verity.d/dracut.pem', suffix is not '.crt'.
[    2.973045] localhost (sd-merge)[510]: No userspace dm-verity certificates found.
```

(cherry picked from commit dfa5aa07b5)
(cherry picked from commit 4a53004a5c)
(cherry picked from commit 4cabbe515e)
This commit is contained in:
Antonio Alvarez Feijoo
2026-04-23 15:39:29 +02:00
committed by Luca Boccassi
parent c13c3926a8
commit f2ea75b64a
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
man/kernel-command-line.xml
View File

@@ -710,8 +710,8 @@
<term><varname>systemd.allow_userspace_verity=</varname></term>
<listitem><para>Takes a boolean argument. Controls whether disk images that are Verity protected may
be authenticated in userspace signature checks via <filename>/etc/verity.d/</filename> (and related
directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
be authenticated in userspace signature checks via <filename>/etc/verity.d/*.crt</filename> (and
related directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
on.</para>
<xi:include href="version-info.xml" xpointer="v256"/></listitem>

2
man/systemd-mountfsd.service.xml
View File

@@ -45,7 +45,7 @@
<filename>/usr/lib/</filename> it is assumed to be trusted.</para></listitem>
<listitem><para>If the disk image contains a Verity enabled disk image, along with a signature
partition with a key in the kernel keyring or in <filename>/etc/verity.d/</filename> (and related
partition with a key in the kernel keyring or in <filename>/etc/verity.d/*.crt</filename> (and related
directories) the disk image is considered trusted.</para></listitem>
</orderedlist>