mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 13:27:45 +00:00
Daan De Meyer
9a8a4428bb
systemd-gpt-auto-generator always passes root-hash-signature=auto for the root and /usr partitions. The data device doesn't have the ID_DISSECT_PART_ROOTHASH_SIG udev property if the image has no signature partition. In that case, systemd-veritysetup fails, and the system can't boot from a verity image that isn't signed. If a signature exists but neither the kernel nor userspace validates it, we activate the device without the signature. The image builder controls whether the image has a signature partition. Whether the boot requires a signature thus depends on the image contents. The failure gives no protection, because an image with a signature that doesn't validate boots. Anyone can avoid the failure by adding a signature partition with any well-formed signature. Whether a signature is required must come from the host. systemd-gpt-auto-generator enables root-hash-signature-required= if systemd.image_policy= requires a signature. With that option, activation fails if the signature is missing or invalid. Let's activate the device without a signature if the property is missing and root-hash-signature-required= isn't enabled.