Secure boot and verification of rootfs

[jsaf0]

Hi all,

We’re looking to harden our system using Orin NX, by extending the secure boot flow include verification of the rootfs as well.

We’re currently using a ext4 filesystem mounted read-only and secure boot up to and including the kernel and initramfs.

Does anyone have experience using dm-verity or similar approaches to ensure full root of trust all the way?

Or are there other better alternatives for Orin NX and meta-tegra?

Thanks!

[yuganshmittal]

Hi @jsaf0

kernel Config: Ensure your kernel fragments include:

CONFIG_DM_VERITY=y

CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y (if you want the kernel to verify the hash signature directly).

or
local.conf:

Python

Enable dm-verity

IMAGE_CLASSES += "dm-verity-img"
IMAGE_FSTYPES += "tegraflash ext4.verity"
DM_VERITY_IMAGE = "core-image-minimal" # Your image name
DM_VERITY_IMAGE_TYPE = "ext4"

Ensure initramfs is used to set up the verity mapping

INITRAMFS_IMAGE = "dm-verity-image-initramfs"

regards,
Yugansh

[ichergui]

Hi @jsaf0
Any update ? or we should close this issue ?