Commits on Sep 6, 2024

1. all: add 'copy' mount option …

   This copies the content of the named composefs image into a sealed memfd
   and mounts that, instead of using the underlying file.
   
   The main benefit here is that the underlying filesystem isn't pinned by
   having one of its files used as the basis of the loopback device.  This
   is useful if you want to embed a composefs into an initramfs, for
   example.
   
   There are also integrity benefits.  Without this option, the fsverity of
   the file is verified at mount time, but nothing stops the file from
   being modified after the fact.  With the copy option, we measure and
   compare the fsverity signature after copying into and sealing the memfd.
   
   Right now this is implemented as a straight copy, but we may also add
   support for decompression at some point.  The erofs images compress
   reasonably well using general-purpose compression algorithms: a 52MB
   image of /usr on my system compresses down to 14MB with zstd and 13MB
   with xz.

   

   allisonkarlitskaya committed Sep 6, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 2fdbf9d
   • Browse repository at this point

   Copy the full SHA

   2fdbf9d View commit details

   Browse the repository at this point in the history