Re: [PATCH] dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE

[Mikulas Patocka <mpatocka@redhat.com>]

On Mon, 21 Sep 2026, Ayoub Zaki wrote:

> Hi,
> 
> 
> On 9/21/26 11:46, Mikulas Patocka wrote:
> > Hi
> > 
> > The argument can be turned off even with your patch - by specifying
> > dm_verity.require_signatures=0 on the kernel command line (read-only
> > module parameters can be modified on the command line during boot).
> > 
> > I'd like to know what kind of security problem does this patch try to
> > solve. If the attacker can tamper with the kernel command line, he can
> > already gain root (i.e. by using init=/bin/bash).
> > 
> > Mikulas
> 
> Thanks for reviewing.
> I should have highlighted the change to bool_enable_only: with
> CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE=y it rejects attempts to clear
> require_signatures, including from the command line.
> I followed the existing CONFIG_MODULE_SIG_FORCE and module.sig_enforce
> implementation.
> My intention is to make signature enforcement a build-time policy rather than
> depend on boot configuration.

OK. I accepted the patch. It will be in 7.4.

Mikulas

> I fully agree with your point and that this patch alone does not protect
> against arbitrary command-line tampering.
> 
> If required I can clarify the scope in a v2 ?