How to Configure Block Device Integrity Verification in Ubuntu Using integritysetup

Silent data corruption—often referred to as “bit rot”—occurs when magnetic media, flash memory cells, or interconnect controllers flip bits or fail to persist sectors correctly without raising a hardware controller error. While traditional Linux filesystems like ext4 or XFS verify filesystem metadata structures, they typically do not compute or enforce cryptographic checksums for underlying user data blocks.

To detect and prevent silent data corruption at the block device level, modern Linux kernels feature the dm-integrity device-mapper target. Managed through the integritysetup utility, dm-integrity calculates cryptographic integrity tags (such as CRC32c or HMAC-SHA256) for every sector written to disk and verifies them upon every read request. This guide demonstrates how to configure, format, open, and manage integrity-protected block devices in Ubuntu.

Understanding dm-integrity and integritysetup Architecture

The dm-integrity target sits between physical storage partitions (or NVMe namespaces) and higher-level filesystems or volume managers:

• Sector-Level Checksumming: Allocates dedicated metadata sectors on the physical drive to store per-block hash tags.
• Immediate Read Failure on Mismatch: If a sector is read and its calculated hash does not match the stored checksum tag, dm-integrity immediately returns an EIO (Input/output error) to the calling process rather than returning corrupt data.
• Stacking Flexibility: Can be deployed directly beneath filesystems (ext4, XFS), underneath software RAID (mdadm), or layered beneath LUKS encryption for authenticated full-disk security.

Installing Required Cryptsetup and Device-Mapper Tools

The integritysetup binary is part of the cryptsetup-bin package on Ubuntu. Verify that the package is installed and up to date:

sudo apt-get update && sudo apt-get install -y cryptsetup-bin

Verify that the kernel module for dm-integrity is loaded or available:

modinfo dm-integrity

Load the module into the active kernel environment:

sudo modprobe dm-integrity

Identifying and Preparing the Target Storage Device

Identify an unmounted, non-root partition dedicated to integrity testing (for example, /dev/sdb1 or /dev/nvme1n1p1) using lsblk:

lsblk -p /dev/sdb

Ensure that the device contains no active filesystems or vital data, as initializing dm-integrity overwrites sector metadata across the device.

Formatting the Partition with integritysetup

To format the storage partition with block-level integrity verification, use integritysetup format. By default, integritysetup uses CRC32c for high-performance, CPU-efficient checksum calculation:

sudo integritysetup format /dev/sdb1

For high-security environments where cryptographic integrity against intentional data tampering is required, specify an HMAC or cryptographic hash algorithm (such as SHA-256):

sudo integritysetup format /dev/sdb1 --integrity sha256

Confirm the format prompt when prompted. The utility writes the initial superblock, allocates metadata sectors, and writes the baseline integrity journal.

Opening and Activating the Integrity Device

Once formatted, map the physical partition to an active virtual block device in /dev/mapper/ using integritysetup open:

sudo integritysetup open /dev/sdb1 data_integrity

Verify that the device mapper node has been created:

ls -l /dev/mapper/data_integrity

Inspect the live operational status and parameters of the mapped integrity device:

sudo integritysetup status data_integrity

The output presents detailed operational statistics:

/dev/mapper/data_integrity is active.
  type:            INTEGRITY
  device:          /dev/sdb1
  tag size:        32 bytes
  integrity:       sha256
  journal size:    33554432 bytes
  provided blocks: 10485760 (4096 bytes each)

Creating and Mounting a Filesystem on the Integrity Layer

Format the mapped device with your preferred Linux filesystem (such as ext4 or XFS):

sudo mkfs.ext4 -L "IntegrityData" /dev/mapper/data_integrity

Create a mount directory and attach the verified volume:

sudo mkdir -p /mnt/integrity-store
sudo mount /dev/mapper/data_integrity /mnt/integrity-store

Verify the mount using df -h and check mount attributes:

df -h /mnt/integrity-store

Simulating and Detecting Corruption in Kernel Logs

To test how the Ubuntu kernel behaves when data corruption occurs, unmount the filesystem and close the device node:

sudo umount /mnt/integrity-store
sudo integritysetup close data_integrity

If physical sectors on the underlying drive /dev/sdb1 are altered directly by hardware faults, reopening the device and reading the affected blocks will trigger dm-integrity alerts:

dmesg | grep -i "dm-integrity"

The kernel journal immediately logs integrity verification failures:

device-mapper: integrity: Checksum failed at sector 2048
device-mapper: integrity: Returning I/O error

Closing the Device Mapping

To safely shut down the integrity target during administrative maintenance:

sudo umount /mnt/integrity-store
sudo integritysetup close data_integrity

By deploying integritysetup and dm-integrity on Ubuntu systems, administrators ensure that silent bit rot is caught instantly before corrupted data can contaminate databases or backups.