My understanding is dm-verity target is read-only so there is no way Yum or any other RPM front end can install a new package on dm-verity enabled block device?

Even if some mechanism is used to update a single package's files on a dm-verity protected block device I/O for those blocks will fail unless hashes for those corresponding blocks are updated?

migrated from security.stackexchange.com Jul 26 '18 at 8:49

This question came from our site for information security professionals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.