Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend integrity protection of LCOW layers to SCSI devices #1170

Merged
merged 4 commits into from
Oct 20, 2021

Conversation

anmaxvl
Copy link
Contributor

@anmaxvl anmaxvl commented Sep 20, 2021

LCOW layers can be added both as VPMem and as SCSI devices.
Previous work focused on enabling integrity protection for read
only VPMem layers, this change enables it for read-only SCSI
devices as well.
Just like in a VPMem scenario, create dm-verity target when
verity information is presented to the guest during SCSI device
mounting step.

Additionally remove unnecessary unit test, since the guest logic
has changed.

Signed-off-by: Maksim An maksiman@microsoft.com

@anmaxvl anmaxvl requested a review from a team as a code owner September 20, 2021 22:31
@anmaxvl
Copy link
Contributor Author

anmaxvl commented Sep 20, 2021

@SeanTAllen as well

@anmaxvl anmaxvl force-pushed the scsi-dm-verity branch 3 times, most recently from 9add2cc to 671b03e Compare September 20, 2021 23:16
@dcantah dcantah self-assigned this Sep 21, 2021
@SeanTAllen
Copy link
Contributor

@anmaxvl I think what I am going to bring up can be done in another PR.

It would be very easy at the code level to accidentally turn off dm-verity setup. Take for example, my not turning it on (inadvertently) in the previous SCSI PR that led to this being its own PR.

I think our best "simple" approach at the unit test level would be to have an interface for device mapper actions that setup verity and have a test that fails if we don't get a "signal" of some sort from our test stand-in for device mapping. It's far from perfect but would give some level of check at unit test time that code wasn't inadvertently removed.

Whatever we do for an approach, we should do for pmem as well.

@anmaxvl anmaxvl force-pushed the scsi-dm-verity branch 3 times, most recently from e0166f2 to bb1be10 Compare September 22, 2021 04:14
@anmaxvl anmaxvl changed the title extend integrity protection of LCOW layers to SCSI devices Extend integrity protection of LCOW layers to SCSI devices Sep 22, 2021
@katiewasnothere katiewasnothere self-assigned this Sep 24, 2021
LCOW layers can be added both as VPMem and as SCSI devices.
Previous work focused on enabling integrity protection for read
only VPMem layers, this change enables it for read-only SCSI
devices as well.
Just like in a VPMem scenario, create dm-verity target when
verity information is presented to the guest during SCSI device
mounting step.

Additionally remove unnecessary unit test, since the guest logic
has changed.

Signed-off-by: Maksim An <maksiman@microsoft.com>
Signed-off-by: Maksim An <maksiman@microsoft.com>
Signed-off-by: Maksim An <maksiman@microsoft.com>
Comment on lines +28 to +30
createZeroSectorLinearTarget = dm.CreateZeroSectorLinearTarget
createVerityTarget = dm.CreateVerityTarget
removeDevice = dm.RemoveDevice
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so, what's the reasoning behind doing this? i found it somewhat confusing and harder to follow what was going on because of this. What is gained by doing this? Testability?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, I added some tests to make sure that the device mapper targets are cleaned up on failure.

Copy link
Contributor

@katiewasnothere katiewasnothere left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@anmaxvl
Copy link
Contributor Author

anmaxvl commented Oct 18, 2021

@dcantah please revisit 😄

Copy link
Contributor

@dcantah dcantah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, this lgtm

Signed-off-by: Maksim An <maksiman@microsoft.com>
@anmaxvl anmaxvl merged commit af3d660 into microsoft:master Oct 20, 2021
@anmaxvl anmaxvl deleted the scsi-dm-verity branch October 20, 2021 00:16
princepereira pushed a commit to princepereira/hcsshim that referenced this pull request Aug 29, 2024
…#1170)

* extend integrity protection of LCOW layers to SCSI devices

LCOW layers can be added both as VPMem and as SCSI devices.
Previous work focused on enabling integrity protection for read
only VPMem layers, this change enables it for read-only SCSI
devices as well.
Just like in a VPMem scenario, create dm-verity target when
verity information is presented to the guest during SCSI device
mounting step.

Additionally remove unnecessary unit test, since the guest logic
has changed.

Add pmem and scsi unit tests for linear/verity device mapper
targets

Signed-off-by: Maksim An <maksiman@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants