mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-01-11 15:00:34 +00:00
Code Issues Projects Releases Wiki Activity

ima,evm: Add two variables to write filenames and signatures into

Browse Source 
Add two variables IMA_FILE_SIGNATURES_FILE and EVM_FILE_SIGNATURES_FILE
for filenames where the ima_evm_sign_rootfs script can write the names
of files and their IMA or EVM signatures into. Both variables are
optional. The content of the file with IMA signatures may look like
this:

/usr/bin/gpiodetect ima:0x0302046730eefd...
/usr/bin/pwscore ima:0x0302046730eefd004...

Having the filenames along with their signatures is useful for signing
files in the initrd when the initrd is running out of a tmpfs filesystem
that has support for xattrs. This allows to enable an IMA appraisal
policy already in the initrd where files must be signed as soon as the
policy becomes active.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Stefan Berger
2023-11-01 13:13:17 -04:00
committed by Armin Kuster
parent 9769990db3
commit 070a1e82cc
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
meta-integrity/classes/ima-evm-rootfs.bbclass
View File

@@ -89,6 +89,18 @@ ima_evm_sign_rootfs () {
bbnote "IMA/EVM: Signing IMA policy with key ${IMA_EVM_PRIVKEY}"
evmctl sign --imasig ${evmctl_param} --portable -a sha256 --key "${IMA_EVM_PRIVKEY}" "${IMAGE_ROOTFS}/etc/ima/ima-policy"
fi
# Optionally write the file names and ima and evm signatures into files
if [ "${IMA_FILE_SIGNATURES_FILE}" ]; then
getfattr -R -m security.ima --e hex --dump ./ 2>/dev/null | \
sed -n -e 's|# file: |/|p' -e 's|security.ima=|ima:|p' | \
sed '$!N;s/\n/ /' > ./${IMA_FILE_SIGNATURES_FILE}
fi
if [ "${EVM_FILE_SIGNATURES_FILE}" ]; then
getfattr -R -m security.evm --e hex --dump ./ 2>/dev/null | \
sed -n -e 's|# file: |/|p' -e 's|security.evm=|evm:|p' | \
sed '$!N;s/\n/ /' > ./${EVM_FILE_SIGNATURES_FILE}
fi
}
# Signing must run as late as possible in the do_rootfs task.