# Cis GCP Cos 1.2.1

> Ensure dm-verity is enabled

- Skill: `cyberstrikeus/cis-gcp-cos-1-2-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gcp-cos-1-2-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gcp-cos-1-2-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gcp-cos-1-2-1

---


# 1.2.1 Ensure dm-verity is enabled (Automated)

## Description

device-mapper-verity (dm-verity) kernel feature provides transparent integrity checking of block devices using a cryptographic digest provided by the kernel crypto API. When a dm-verity device is configured, it is expected that the caller has been authenticated in some way (cryptographic signatures, etc). After instantiation, all hashes will be verified on-demand during disk access. If they cannot be verified up to the root node of the tree, the root hash, then the I/O will fail. This should detect tampering with any data on the device and the hash data.

## Rationale

The Container-Optimized OS root filesystem is always mounted as read-only. Additionally, its checksum is computed at build time and verified by the kernel on each boot. This mechanism prevents against attackers from "owning" the machine through permanent local changes.

## Audit Procedure

Verify dm-verity is enabled in kernel config with the following command:

```bash
# zcat /proc/config.gz | grep CONFIG_DM_VERITY
CONFIG_DM_VERITY=y
```

## Expected Result

The output should show `CONFIG_DM_VERITY=y`.

## Remediation

An OS image update that has the dm-verity enabled kernel is required.

## References

1. AIDE stable manual: http://aide.sourceforge.net/stable/manual.html

## Additional Information

The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Run `prelink -ua` to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.

## CIS Controls

| Controls Version | Control                                                             | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.14 Log Sensitive Data Access                                      |      |      | x    |
| v8               | 8.5 Collect Detailed Audit Logs                                     |      | x    | x    |
| v7               | 14.9 Enforce Detail Logging for Access or Changes to Sensitive Data |      |      | x    |

## Profile

Level 1 - Server | Automated