1INTEGRITYTAB(5) integritytab INTEGRITYTAB(5)
2
6 integritytab - Configuration for integrity block devices
7
9 /etc/integritytab
10
12 The /etc/integritytab file describes integrity protected block devices
13 that are set up during system boot.
14 Empty lines and lines starting with the "#" character are ignored. Each
16 of the remaining lines describes one verity integrity protected block
17 device. Fields are delimited by white space.
18 Each line is in the form
20 volume-name block-device
22 [keyfile|-] [options|-]
23 The first two fields are mandatory, the remaining two are optional and
25 only required if user specified non-default options during integrity
26 format.
27 The first field contains the name of the resulting integrity volume;
29 its block device is set up below /dev/mapper/.
30 The second field contains a path to the underlying block device, or a
32 specification of a block device via "UUID=" followed by the UUID,
33 "PARTUUID=" followed by the partition UUID, "LABEL=" followed by the
34 label, "PARTLABEL=" followed by the partition label.
35 The third field if present contains an absolute filename path to a key
37 file or a "-" to specify none. When the filename is present, the
38 "integrity-algorithm" defaults to "hmac-sha256" with the key length
39 derived from the number of bytes in the key file. At this time the only
40 supported integrity algorithm when using key file is hmac-sha256. The
41 maximum size of the key file is 4096 bytes.
42 The fourth field, if present, is a comma-delimited list of options or a
44 "-" to specify none. The following options are recognized:
45 allow-discards
47 Allow the use of discard (TRIM) requests for the device. This
48 option is available since the Linux kernel version 5.7.
49 mode=(journal|bitmap|direct)
51 Enable journaled, bitmapped or direct (passthrough) mode. Journaled
52 mode is the default when this option is not specified. It provides
53 safety against crashes, but can be slow because all data has to be
54 written twice. Bitmap mode is more efficient since it requires only
55 a single write, but it is less reliable because if data corruption
56 happens when the machine crashes, it may not be detected. Direct
57 mode disables the journal and the bitmap. Corresponds to the
58 "direct writes" mode documented in the dm-integrity
59 documentation[1]. Note that without a journal, if there is a crash,
60 it is possible that the integrity tags and data will not match. If
61 used, the journal-* options below will have no effect if passed.
62 journal-watermark=[0..100]%
64 Journal watermark in percent. When the journal percentage exceeds
65 this watermark, the journal flush will be started. Setting a value
66 of "0%" uses default value.
67 journal-commit-time=[0..N]
69 Commit time in milliseconds. When this time passes (and no explicit
70 flush operation was issued), the journal is written. Setting a
71 value of zero uses default value.
72 data-device=/dev/disk/by-...
74 Specify a separate block device that contains existing data. The
75 second field specified in the integritytab for block device then
76 will contain calculated integrity tags and journal for data-device,
77 but not the end user data.
78 integrity-algorithm=[crc32c|crc32|sha1|sha256|hmac-sha256]
80 The algorithm used for integrity checking. The default is crc32c.
81 Must match option used during format.
82 At early boot and when the system manager configuration is reloaded,
84 this file is translated into native systemd units by systemd-
85 integritysetup-generator(8).
86
88 Example 1. /etc/integritytab
89 Set up two integrity protected block devices.
91 home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 - journal-commit-time=10,allow-discards,journal-watermark=55%
93 data PARTUUID=5d4b1808-be76-774d-88af-03c4c3a41761 - allow-discards
94 Example 2. /etc/integritytab
96 Set up 1 integrity protected block device using defaults
98 home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8
100 Example 3. /etc/integritytab
102 Set up 1 integrity device using existing data block device which
104 contains user data
105 home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 - data-device=/dev/disk/by-uuid/9276d9c0-d4e3-4297-b4ff-3307cd0d092f
107 Example 4. /etc/integritytab
109 Set up 1 integrity device using a HMAC key file using defaults
111 home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 /etc/hmac.key
113
115 systemd(1), systemd-integritysetup@.service(8), systemd-integritysetup-
116 generator(8), integritysetup(8),
117
119 1. the dm-integrity documentation
120 https://docs.kernel.org/admin-guide/device-mapper/dm-integrity.html
121systemd 254 INTEGRITYTAB(5)