On Fri, 2021-12-03 at 12:21 +0100, Vitaly Zaitsev via devel wrote:
On 02/12/2021 20:36, Ben Cotton wrote:
> Enable the use of fsverity for installed RPM files validation.
-1. RPM already supports files validation and this feature will waste
file system space.
To clarify: RPM does support files validation, but fs-verity is more
than just that. With RPM, the validation only happens on install time,
and when one runs rpm -V manually. With fs-verity, the validation
happens on-demand whenever a block of a file that originated from an
RPM is accessed. This means, for example, that if an attacker replaces
/bin/ls on disk with a compromised one, the next time it's read from
disk (e.g. because you ran it) you will see a validation failure and
the syscall will be blocked, preventing the compromised code from being
executed.
About filesystem usage: unless you install rpm-plugin-fsverity (which
is not and will not be installed by default), there is no disk space
increase for verity-signed RPM packages. If you do install rpm-plugin-
fsverity, some disk space will be used for the Merkle tree as described
in the Change.
Cheers
Davide