# systemd-veritysetup-generator

## NAME



           systemd-veritysetup-generator - Unit generator for verity
           protected block devices
    


## SYNOPSIS



           /usr/lib/systemd/system-generators/systemd-veritysetup-generator
    


## DESCRIPTION



           **systemd-veritysetup-generator** is a generator that translates
           kernel command line options configuring verity protected block
           devices into native systemd units early at boot and when
           configuration of the system manager is reloaded. This will create
           systemd-veritysetup@.service(8) units as necessary.
    
           Currently, only two verity devices may be set up with this
           generator, backing the root and /usr file systems of the OS.
    
           **systemd-veritysetup-generator** implements systemd.generator(7).
    


## KERNEL COMMAND LINE



           **systemd-veritysetup-generator** understands the following kernel
           command line parameters:
    
           _systemd.verity=_ , _rd.systemd.verity=_
               Takes a boolean argument. Defaults to "yes". If "no", disables
               the generator entirely.  _rd.systemd.verity=_ is honored only in
               the initrd while _systemd.verity=_ is honored by both the main
               system and in the initrd.
    
               Added in version 233.
    
           _veritytab=_ , _rd.veritytab=_
               Takes a boolean argument. Defaults to "yes". If "no", causes
               the generator to ignore any devices configured in
               /etc/veritytab.  _rd.veritytab=_ is honored only in the initrd
               while _veritytab=_ is honored by both the main system and in the
               initrd.
    
               Added in version 248.
    
           _roothash=_
               Takes a root hash value for the root file system. Expects a
               hash value formatted in hexadecimal characters of the
               appropriate length (i.e. most likely 256 bit/64 characters, or
               longer). If not specified via _systemd.verity_root_data=_ and
               _systemd.verity_root_hash=_ , the hash and data devices to use
               are automatically derived from the specified hash value.
               Specifically, the data partition device is looked for under a
               GPT partition UUID derived from the first 128-bit of the root
               hash, the hash partition device is looked for under a GPT
               partition UUID derived from the last 128-bit of the root hash.
               Hence it is usually sufficient to specify the root hash to
               boot from a verity protected root file system, as device paths
               are automatically determined from it — as long as the
               partition table is properly set up.
    
               Added in version 233.
    
           _systemd.verity_root_data=_ , _systemd.verity_root_hash=_
               These two settings take block device paths as arguments and
               may be used to explicitly configure the data partition and
               hash partition to use for setting up the verity protection for
               the root file system. If not specified, these paths are
               automatically derived from the _roothash=_ argument (see above).
    
               Added in version 233.
    
           _systemd.verity_root_options=_
               Takes a comma-separated list of dm-verity options. Expects the
               following options **superblock=**_BOOLEAN_ , **format=**_NUMBER_ ,
               **data-block-size=**_BYTES_ , **hash-block-size=**_BYTES_ ,
               **data-blocks=**_BLOCKS_ , **hash-offset=**_BYTES_ , **salt=**_HEX_ , **uuid=**_UUID_ ,
               **ignore-corruption** , **restart-on-corruption** , **ignore-zero-blocks** ,
               **check-at-most-once** , **panic-on-corruption** , **hash=**_HASH_ ,
               **fec-device=**_PATH_ , **fec-offset=**_BYTES_ , **fec-roots=**_NUM_ and
               **root-hash-signature=**_PATH_**|base64:**_HEX_. See veritysetup(8) for
               more details.
    
               Added in version 248.
    
           _usrhash=_ , _systemd.verity_usr_data=_ , _systemd.verity_usr_hash=_ ,
           _systemd.verity_usr_options=_
               Equivalent to their counterparts for the root file system as
               described above, but apply to the /usr/ file system instead.
    
               Added in version 250.
    


* * *