shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-28 11:21:59 +03:00
Code
a5fcbfea45
systemd/man/systemd-veritysetup@.service.xml

105 lines
3.8 KiB
XML
Raw Normal View History

verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
<?xml version="1.0"?>
<!--*-nxml-*-->
man: use same header for all files The "include" files had type "book" for some raeason. I don't think this is meaningful. Let's just use the same everywhere. $ perl -i -0pe 's^..DOCTYPE (book|refentry) PUBLIC "-//OASIS//DTD DocBook XML V4.[25]//EN"\s+"http^<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"\n "http^gms' man/*.xml
2019-03-14 16:40:58 +03:00
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
man: Add xinclude namespace This will be used by the next commit to add version information to the nodes.
2023-08-22 19:52:02 +03:00
<refentry id="systemd-veritysetup@.service" conditional='HAVE_LIBCRYPTSETUP'
xmlns:xi="http://www.w3.org/2001/XInclude">
verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
<refentryinfo>
<title>systemd-veritysetup@.service</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>systemd-veritysetup@.service</refentrytitle>
<manvolnum>8</manvolnum>
</refmeta>
<refnamediv>
<refname>systemd-veritysetup@.service</refname>
<refname>systemd-veritysetup</refname>
dm-verity: Remove usage of integrity There is a difference between dm-verity and dm-integrity. Remove usage of integrity from verity documentation in man pages and target files.
2021-10-13 22:18:12 +03:00
<refpurpose>Disk verity protection logic</refpurpose>
verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
</refnamediv>
<refsynopsisdiv>
<para><filename>systemd-veritysetup@.service</filename></para>
<para><filename>/usr/lib/systemd/systemd-veritysetup</filename></para>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
dm-verity: Remove usage of integrity There is a difference between dm-verity and dm-integrity. Remove usage of integrity from verity documentation in man pages and target files.
2021-10-13 22:18:12 +03:00
<para><filename>systemd-veritysetup@.service</filename> is a service responsible for setting up verity
protection block devices. It should be instantiated for each device that requires verity
verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
protection.</para>
<para>At early boot and when the system manager configuration is reloaded kernel command line configuration for
dm-verity: Remove usage of integrity There is a difference between dm-verity and dm-integrity. Remove usage of integrity from verity documentation in man pages and target files.
2021-10-13 22:18:12 +03:00
verity protected block devices is translated into <filename>systemd-veritysetup@.service</filename> units by
verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
<citerefentry><refentrytitle>systemd-veritysetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
man: describe veritysetup command syntax It makes it easier to diagnose what the generated units actually do.
2021-07-31 10:16:52 +03:00
<para><filename>systemd-veritysetup@.service</filename> calls <command>systemd-veritysetup</command>.</para>
</refsect1>
<refsect1>
<title>Commands</title>
<para>The following commands are understood by <command>systemd-veritysetup</command>:</para>
<variablelist>
<varlistentry>
<term>
<option>attach</option>
<replaceable>volume</replaceable>
<replaceable>datadevice</replaceable>
<replaceable>hashdevice</replaceable>
<replaceable>roothash</replaceable>
[<replaceable>option</replaceable>...]
</term>
<listitem><para>Create a block device <replaceable>volume</replaceable> using
<replaceable>datadevice</replaceable> and <replaceable>hashdevice</replaceable> as the backing
devices. <replaceable>roothash</replaceable> forms the root of the tree of hashes stored on
<replaceable>hashdevice</replaceable>. See
tree-wide: link to docs.kernel.org for kernel documentation https://www.kernel.org/ links to https://docs.kernel.org/ for the documentation. See https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=ebc1c372850f249dd143c6d942e66c88ec610520 These URLs are shorter and nicer looking.
2022-07-04 17:26:30 +03:00
<ulink url="https://docs.kernel.org/admin-guide/device-mapper/verity.html">
man: describe veritysetup command syntax It makes it easier to diagnose what the generated units actually do.
2021-07-31 10:16:52 +03:00
Kernel dm-verity</ulink> documentation for details.
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-22 19:52:36 +03:00
</para>
<xi:include href="version-info.xml" xpointer="v250"/></listitem>
man: describe veritysetup command syntax It makes it easier to diagnose what the generated units actually do.
2021-07-31 10:16:52 +03:00
</varlistentry>
<varlistentry>
<term>
<option>detach</option>
<replaceable>volume</replaceable>
</term>
<listitem><para>Detach (destroy) the block device
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-22 19:52:36 +03:00
<replaceable>volume</replaceable>.</para>
<xi:include href="version-info.xml" xpointer="v250"/></listitem>
man: describe veritysetup command syntax It makes it easier to diagnose what the generated units actually do.
2021-07-31 10:16:52 +03:00
</varlistentry>
<varlistentry>
<term>
<option>help</option>
</term>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-22 19:52:36 +03:00
<listitem><para>Print short information about command syntax.</para>
<xi:include href="version-info.xml" xpointer="v250"/></listitem>
man: describe veritysetup command syntax It makes it easier to diagnose what the generated units actually do.
2021-07-31 10:16:52 +03:00
</varlistentry>
</variablelist>
verity: add support for setting up verity-protected root disks in the initrd This adds a generator and a small service that will look for "roothash=" on the kernel command line and use it for setting up a very partition for the root device. This provides similar functionality to nspawn's existing --roothash= switch.
2016-12-16 14:57:44 +03:00
</refsect1>
<refsect1>
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-veritysetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry project='die-net'><refentrytitle>veritysetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</para>
</refsect1>
</refentry>
Copy Permalink