[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXI6M3MGRnp31-HneBZH9Y1-wO1Gco4v1vL7OKo5Oi58":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"88d3a5ad-cab3-417d-ae91-4ec3431c4df8","article","fs-verity：文件边读边验，怎样发现磁盘内容被改过？","fs-verity-file-integrity-merkle-tree","fs-verity 使用 Merkle 哈希树在文件读取时检查内容完整性。本文解释它如何验证单个只读文件、为什么根哈希仍需要可信来源，以及它和面向块设备的 dm-verity 有何不同。","下载完成的文件如果在磁盘上被意外改写，系统能否在应用读取时发现？fs-verity 提供了一种面向单个文件的完整性验证机制：它为只读文件建立 Merkle 哈希树，之后读取内容时逐层核对数据是否与树中的哈希一致。\n\n先从哈希说起。哈希函数会把一段数据变成固定长度的摘要；数据只改动一个比特，摘要通常就会不同。Merkle 树则把很多小块的哈希组合起来，再不断向上汇总，最终得到一个根哈希。验证某个数据块时，不必把整份文件全部读完，只需检查该块及其通往根节点的那条路径。fs-verity 利用这种结构，把文件内容与根哈希绑定起来。\n\n启用后，文件系统可以在数据页进入内存时验证其完整性。如果底层存储数据意外损坏或被篡改，验证就会失败，而不是把未经确认的内容悄悄交给应用。因为树结构允许局部证明，这种方式适合体积较大、读取位置不固定的文件，例如应用包、系统镜像中的单个文件或经验证的静态资源。\n\n不过，完整性验证不等于“确认是谁发布的”。fs-verity 能告诉你读取到的文件是否符合某个根哈希，却不能单独证明这个根哈希来自可信开发者。如果攻击者能同时替换文件和系统信任的根哈希，校验仍可能通过。通常还需要数字签名、可信的软件分发链或由系统管理的哈希清单，来回答“应该相信哪个根哈希”。\n\n它也不等同于 dm-verity。fs-verity 面向单个文件，允许在文件系统中逐文件启用；dm-verity 则主要在块设备或只读文件系统层面验证数据。两者使用 Merkle 树的思路相近，但保护对象、配置方式和使用场景不同。理解这个差别有助于判断完整性策略应该放在文件级还是整块存储级。\n\n还有一个重要前提：启用验证的文件按设计是不可随意修改的。若应用要更新内容，通常要以新的受验证文件替换旧版本，而不是原地改变已保护文件。总体而言，fs-verity 把“读到的内容是否还是原来那份”变成了内核可检查的问题；要建立真正的信任，还要把校验结果与可靠的签名和更新流程连接起来。\n\n来源：[Linux 内核文档：fs-verity](https:\u002F\u002Fdocs.kernel.org\u002Ffilesystems\u002Ffsverity.html)","\u002Fuploads\u002F2026-10-13\u002Fa21ac9a6-cd92-4581-901b-cacc683772f9.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Linux Kernel Documentation","https:\u002F\u002Fdocs.kernel.org\u002Ffilesystems\u002Ffsverity.html","published",false,55,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:35.631Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T02:13:55.563Z"]