Cis GCP Cos 1.2.1

1.2.1 Ensure dm-verity is enabled (Automated)

Description

device-mapper-verity (dm-verity) kernel feature provides transparent integrity checking of block devices using a cryptographic digest provided by the kernel crypto API. When a dm-verity device is configured, it is expected that the caller has been authenticated in some way (cryptographic signatures, etc). After instantiation, all hashes will be verified on-demand during disk access. If they cannot be verified up to the root node of the tree, the root hash, then the I/O will fail. This should detect tampering with any data on the device and the hash data.

Rationale

The Container-Optimized OS root filesystem is always mounted as read-only. Additionally, its checksum is computed at build time and verified by the kernel on each boot. This mechanism prevents against attackers from "owning" the machine through permanent local changes.

Audit Procedure

Verify dm-verity is enabled in kernel config with the following command:

# zcat /proc/config.gz | grep CONFIG_DM_VERITY
CONFIG_DM_VERITY=y

Expected Result

The output should show CONFIG_DM_VERITY=y.

Remediation

An OS image update that has the dm-verity enabled kernel is required.

References

1. AIDE stable manual: http://aide.sourceforge.net/stable/manual.html

Additional Information

The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Run prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.

CIS Controls

Profile

Level 1 - Server | Automated