Hi, I’m the Toradex AI Assistant. I’m in early beta, and I would appreciate your feedback.
The Toradex Support team will follow up with you shortly!
Did you like my answer?
Hello,
Securing the Torizon OS root filesystem (rootfs) with dm-verity involves several steps and configurations, especially when combined with U-Boot hardening and the use of a signed boot process. Your approach to integrating dm-verity for the Apalis iMX8 module by setting DM_VERITY_IMAGE = “torizon-core-docker” in your Yocto build environment is a step in the right direction for securing the entire rootfs. This setting specifies the image that dm-verity should protect, aiming to ensure its integrity at runtime.
However, the issue you’re encountering with boot.scr not being executed due to U-Boot hardening is significant. U-Boot hardening often involves measures that restrict the execution of scripts and commands that are not explicitly allowed or signed, which can interfere with the normal boot process if boot.scr is involved. This script is crucial for setting up the environment and parameters for booting Linux, including dm-verity configurations.
To address the boot script execution issue, you might need to adjust your U-Boot hardening configuration to allow the execution of boot.scr. This could involve adding exceptions or signatures for the script, depending on your hardening strategy. It’s essential to ensure that any changes maintain the security posture you’re aiming for with hardening.
Regarding controlling CLI access with the device tree, it’s a viable solution for certain scenarios, but it might not directly address the issues you’re facing with dm-verity and U-Boot hardening. Device tree modifications can help control hardware access and features at the kernel level but are less related to the execution policies of U-Boot.
For the DM_VERITY_IMAGE setting, using “torizon-core-docker” is generally correct for applying dm-verity to the entire rootfs in a TorizonCore build. This setting indicates that the dm-verity protection should apply to the image containing the Docker runtime and containers, which is a significant part of the Torizon OS. To ensure this setting is effectively securing the rootfs, you should verify that the build process completes without errors and that the dm-verity verification is active at runtime. This typically involves checking the boot logs for dm-verity messages indicating that integrity checks are being performed.
If you continue to face issues, it may be necessary to review the specific configurations and steps you’ve taken in both the U-Boot hardening and the dm-verity setup. Ensuring compatibility between these security features requires careful configuration and sometimes custom adjustments to
Please, also check if these links can help you solve your problem:
Secure Boot on Torizon OS | Toradex Developer Center.
