1"use strict";(self.webpackChunkpantavisor_docs=self.webpackChunkpantavisor_docs||[]).push([["13782"],{1951(e,t,n){n.r(t),n.d(t,{metadata:()=>r,default:()=>l,frontMatter:()=>a,contentTitle:()=>o,toc:()=>c,assets:()=>d});var r=JSON.parse('{"id":"meta-pantavisor/getting-started/security/trust-model","title":"Trust model","description":"Pantavisor\'s trust model \u2014 what it protects, the trust boundaries from secure boot to per-container integrity, and why owning PID 1 raises the bar rather than lowering it.","source":"@site/reference/meta-pantavisor/getting-started/security/trust-model.md","sourceDirName":"meta-pantavisor/getting-started/security","slug":"/meta-pantavisor/getting-started/security/trust-model","permalink":"/meta-pantavisor/getting-started/security/trust-model","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":2,"frontMatter":{"title":"Trust model","sidebar_position":2,"description":"Pantavisor\'s trust model \u2014 what it protects, the trust boundaries from secure boot to per-container integrity, and why owning PID 1 raises the bar rather than lowering it."},"sidebar":"metaPantavisorGettingStartedSidebar","previous":{"title":"Atomicity and trust evidence","permalink":"/meta-pantavisor/getting-started/security/atomicity-and-trust"},"next":{"title":"Benchmarks and comparisons","permalink":"/meta-pantavisor/getting-started/benchmarks/"}}'),i=n(74848),s=n(28453);let a={title:"Trust model",sidebar_position:2,description:"Pantavisor's trust model \u2014 what it protects, the trust boundaries from secure boot to per-container integrity, and why owning PID 1 raises the bar rather than lowering it."},o="Trust model",d={},c=[{value:"What Pantavisor protects",id:"what-pantavisor-protects",level:2},{value:"Trust boundaries",id:"trust-boundaries",level:2},{value:"The chain, end to end",id:"the-chain-end-to-end",level:2},{value:"Why PID 1 raises the bar, not lowers it",id:"why-pid-1-raises-the-bar-not-lowers-it",level:2},{value:"The recertification advantage",id:"the-recertification-advantage",level:2}];function h(e){let t={a:"a",blockquote:"blockquote",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.header,{children:(0,i.jsx)(t.h1,{id:"trust-model",children:"Trust model"})}),"\n",(0,i.jsxs)(t.p,{children:["Pantavisor owns PID 1 \u2014 the kernel's first, always-running process, normally\n",(0,i.jsx)(t.code,{children:"init"}),"/",(0,i.jsx)(t.code,{children:"systemd"})," \u2014 so it must clear a higher bar than an updater you can\ndelete. This page describes what Pantavisor protects, the trust boundaries\ninvolved, and how the pieces compose into a chain from power-on to a running\ncontainer. For the power-fail evidence behind the atomicity claims, see\n",(0,i.jsx)(t.a,{href:"/meta-pantavisor/getting-started/security/atomicity-and-trust",children:"Atomicity and trust evidence"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"what-pantavisor-protects",children:"What Pantavisor protects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Integrity of the device state"})," \u2014 the kernel, BSP, every container, and\nconfiguration are described as content-addressed ",(0,i.jsx)(t.a,{href:"/pantavisor/overview/storage",children:"objects"}),"\nunder one signed ",(0,i.jsx)(t.a,{href:"/pantavisor/overview/revisions",children:"revision"}),". Tampering with\nany object changes its hash and breaks the signature."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Integrity at runtime"})," \u2014 container root filesystems are verified as they are\nmounted, not only at download time."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Confidentiality of stored state"})," \u2014 the storage partition can be encrypted."]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Recoverability"})," \u2014 a revision that fails its health checks is rolled back\nautomatically to the last known-good state."]}),"\n"]}),"\n",(0,i.jsx)(t.h2,{id:"trust-boundaries",children:"Trust boundaries"}),"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Boundary"}),(0,i.jsx)(t.th,{children:"Mechanism"}),(0,i.jsx)(t.th,{children:"Notes"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Power-on \u2192 bootloader"}),(0,i.jsx)(t.td,{children:"Secure boot (SoC ROM verifies a signed bootloader)"}),(0,i.jsx)(t.td,{children:"Platform-dependent; see your board's secure-boot support."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Bootloader \u2192 kernel/initramfs"}),(0,i.jsx)(t.td,{children:"Signed FIT image"}),(0,i.jsx)(t.td,{children:"The bootloader only boots a signed image."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Initramfs \u2192 device state"}),(0,i.jsxs)(t.td,{children:["Signed revision (",(0,i.jsx)(t.code,{children:"pvr sig"}),", X.509)"]}),(0,i.jsx)(t.td,{children:"One signature transitively covers the whole revision."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Mount \u2192 running container"}),(0,i.jsx)(t.td,{children:"dm-verity"}),(0,i.jsx)(t.td,{children:"Per-container rootfs integrity is checked at mount time."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Storage at rest"}),(0,i.jsx)(t.td,{children:"dm-crypt"}),(0,i.jsx)(t.td,{children:"Encryption of the storage partition (dm-crypt)."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Update commit"}),(0,i.jsx)(t.td,{children:"Health-gated commit + bootloader try/rollback"}),(0,i.jsx)(t.td,{children:"A trial revision must pass readiness probes before it is marked good."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Liveness backstop"}),(0,i.jsx)(t.td,{children:"Hardware watchdog fed by PID 1"}),(0,i.jsx)(t.td,{children:"If Pantavisor stops feeding it, the device resets."})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"the-chain-end-to-end",children:"The chain, end to end"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"SoC ROM\n \u2514\u2500 verifies \u2192 signed bootloader\n \u2514\u2500 verifies \u2192 signed FIT (kernel + Pantavisor initramfs)\n \u2514\u2500 Pantavisor (PID 1) verifies \u2192 signed revision\n \u2514\u2500 mounts each container rootfs under \u2192 dm-verity\n \u2514\u2500 (storage partition encrypted with dm-crypt)\n"})}),"\n",(0,i.jsx)(t.p,{children:"Each link only hands control to the next if the next artifact verifies. A break\nanywhere stops the boot or triggers rollback rather than running unverified\ncode."}),"\n",(0,i.jsx)(t.h2,{id:"why-pid-1-raises-the-bar-not-lowers-it",children:"Why PID 1 raises the bar, not lowers it"}),"\n",(0,i.jsxs)(t.p,{children:["A conventional updater is a process you can stop, replace, or remove \u2014 its\nguarantees end where the surrounding OS begins. Because Pantavisor ",(0,i.jsx)(t.em,{children:"is"})," the init\nsystem and the update path, its atomicity and rollback guarantees apply to the\n",(0,i.jsx)(t.strong,{children:"whole device"}),", including the base and kernel, and they are held to a higher\nstandard precisely because there is no layer underneath to fall back on. That is\nwhy the trust story is backed by a documented, reproducible\n",(0,i.jsx)(t.a,{href:"/meta-pantavisor/getting-started/security/atomicity-and-trust",children:"power-fail and rollback test methodology"}),"\n(results forthcoming) rather than assertion alone."]}),"\n",(0,i.jsx)(t.h2,{id:"the-recertification-advantage",children:"The recertification advantage"}),"\n",(0,i.jsxs)(t.p,{children:["Because an application update changes only its own container's objects \u2014 never\nthe certified base container's hashes \u2014 a frozen, certified base/BSP keeps its\nsafety case while apps iterate above it. This is the core of the\n",(0,i.jsx)(t.a,{href:"/meta-pantavisor/getting-started/security/",children:"recertification model"}),": certify the base once, ship app containers\nwithout re-touching it."]}),"\n",(0,i.jsxs)(t.blockquote,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"\u{1F4DD} Note"})}),"\n",(0,i.jsxs)(t.p,{children:["Secure boot specifics (key provisioning, FIT signing, fuse burning) are\nplatform-dependent. Treat your board's reference material and the\n",(0,i.jsx)(t.a,{href:"/meta-pantavisor/overview/get-started",children:"build/secure-boot integration"})," guidance as authoritative for your SoC."]}),"\n"]})]})}function l(e={}){let{wrapper:t}={...(0,s.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},28453(e,t,n){n.d(t,{R:()=>a,x:()=>o});var r=n(96540);let i={},s=r.createContext(i);function a(e){let t=r.useContext(s);return r.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.