1INTEGRITYTAB(5)                  integritytab                  INTEGRITYTAB(5)
2
3
4

NAME

6       integritytab - Configuration for integrity block devices
7

SYNOPSIS

9       /etc/integritytab
10

DESCRIPTION

12       The /etc/integritytab file describes integrity protected block devices
13       that are set up during system boot.
14
15       Empty lines and lines starting with the "#" character are ignored. Each
16       of the remaining lines describes one verity integrity protected block
17       device. Fields are delimited by white space.
18
19       Each line is in the form
20
21           volume-name block-device
22               [keyfile|-] [options|-]
23
24       The first two fields are mandatory, the remaining two are optional and
25       only required if user specified non-default options during integrity
26       format.
27
28       The first field contains the name of the resulting integrity volume;
29       its block device is set up below /dev/mapper/.
30
31       The second field contains a path to the underlying block device, or a
32       specification of a block device via "UUID=" followed by the UUID,
33       "PARTUUID=" followed by the partition UUID, "LABEL=" followed by the
34       label, "PARTLABEL=" followed by the partition label.
35
36       The third field if present contains an absolute filename path to a key
37       file or a "-" to specify none. When the filename is present, the
38       "integrity-algorithm" defaults to "hmac-sha256" with the key length
39       derived from the number of bytes in the key file. At this time the only
40       supported integrity algorithm when using key file is hmac-sha256. The
41       maximum size of the key file is 4096 bytes.
42
43       The fourth field, if present, is a comma-delimited list of options or a
44       "-" to specify none. The following options are recognized:
45
46       allow-discards
47           Allow the use of discard (TRIM) requests for the device. This
48           option is available since the Linux kernel version 5.7.
49
50       journal-watermark=[0..100]%
51           Journal watermark in percent. When the journal percentage exceeds
52           this watermark, the journal flush will be started. Setting a value
53           of "0%" uses default value.
54
55       journal-commit-time=[0..N]
56           Commit time in milliseconds. When this time passes (and no explicit
57           flush operation was issued), the journal is written. Setting a
58           value of zero uses default value.
59
60       data-device=/dev/disk/by-...
61           Specify a separate block device that contains existing data. The
62           second field specified in the integritytab for block device then
63           will contain calculated integrity tags and journal for data-device,
64           but not the end user data.
65
66       integrity-algorithm=[crc32c|crc32|sha1|sha256|hmac-sha256]
67           The algorithm used for integrity checking. The default is crc32c.
68           Must match option used during format.
69
70       At early boot and when the system manager configuration is reloaded,
71       this file is translated into native systemd units by systemd-
72       integritysetup-generator(8).
73

EXAMPLES

75       Example 1. /etc/integritytab
76
77       Set up two integrity protected block devices.
78
79           home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 - journal-commit-time=10,allow-discards,journal-watermark=55%
80           data PARTUUID=5d4b1808-be76-774d-88af-03c4c3a41761 - allow-discards
81
82       Example 2. /etc/integritytab
83
84       Set up 1 integrity protected block device using defaults
85
86           home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8
87
88       Example 3. /etc/integritytab
89
90       Set up 1 integrity device using existing data block device which
91       contains user data
92
93           home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 - data-device=/dev/disk/by-uuid/9276d9c0-d4e3-4297-b4ff-3307cd0d092f
94
95       Example 4. /etc/integritytab
96
97       Set up 1 integrity device using a HMAC key file using defaults
98
99           home PARTUUID=4973d0b8-1b15-c449-96ec-94bab7f6a7b8 /etc/hmac.key
100

SEE ALSO

102       systemd(1), systemd-integritysetup@.service(8), systemd-integritysetup-
103       generator(8), integritysetup(8),
104
105
106
107systemd 251                                                    INTEGRITYTAB(5)
Impressum