Linux Security Summit North America 2018

The Android platform uses dm-verity to protect its system image, but there are critical components in that image that require incremental updates. Michael Halcrow and Eric Biggers introduce fs-verity as a mechanism for file systems to validate the authenticity of individual files. They furthermore propose fs-verity as a capability that can integrate with the Integrity Measurement Architecture (IMA) to efficiently validate only the parts of a file that are accessed. They will also discuss potential applications of file-based authenticity in validating container image content.