mirrors/meta-secure-core
1
0
Fork 0
mirror of https://github.com/jiazhang0/meta-secure-core.git synced 2026-07-16 20:56:58 +00:00
Code Issues Projects Releases Wiki Activity

meta-integrity, meta-signing-key: Populate the secondary keyring

Browse Source 
Currently we provide a secondary trusted key that is signed by the
primary key.  We do not however DER encode this certificate.  Update
the key-store recipe to also make a DER encoding of this certificate and
include it in the same package as the PEM version of the certificate.
In the IMA init script, if we have any secondary certificate in a DER
encoding, load them into the secondary keyring before we try and load
the IMA keys.

Signed-off-by: Tom Rini <trini@konsulko.com>
This commit is contained in:
Tom Rini
2018-05-16 23:08:35 -04:00
committed by Jia Zhang
parent c804f25914
commit a8419d577a
2 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-integrity/recipes-core/initrdscripts/files/init.ima
+13
View File
@@ -97,6 +97,19 @@ fi
mount --move ${ROOT_DIR}/proc /proc
# If we have a secondary trusted keyring, here is the opportunity to load
# additional trusted keys from the real rootfs.
for cert in ${ROOT_DIR}/etc/keys/x509_secondary_*.der; do
[ ! -s "$cert" ] && continue
name=`basename $cert`
if ! keyctl padd asymmetric "$name" %:.secondary_trusted_keys < $cert > ${ROOT_DIR}/dev/null; then
print_critical "Unable to load the secondary certificate $cert"
else
print_verbose "The secondary certificate $cert has been loaded"
fi
done
# The trusted IMA certificate /etc/keys/x509_evm.der in initramfs was
# automatically loaded by kernel already. Here is the opportunity to load
# a custom IMA certificate from the real rootfs.