mirror of
https://git.yoctoproject.org/meta-security
synced 2026-05-06 16:48:42 +00:00
swtpm-wrappers: wrap more commands
Soon it might be possible to let qemu start swtpm directly, without requiring root privileges as for swtpm_cuse. For that to work we also need to wrap the swtpm binary. Just in case we now also do it for everything. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
This commit is contained in:
committed by
Armin Kuster
parent
86b2a2b2ef
commit
1cca28c3d5
@@ -9,7 +9,13 @@ inherit native
|
||||
RM_WORK_EXCLUDE += "${PN}"
|
||||
|
||||
do_create_wrapper () {
|
||||
cat >${WORKDIR}/swtpm_setup_oe.sh <<EOF
|
||||
# Wrap (almost) all swtpm binaries. Some get special wrappers and some
|
||||
# are not needed.
|
||||
for i in `find ${bindir} ${base_bindir} ${sbindir} ${base_sbindir} -name 'swtpm*' -perm /+x -type f`; do
|
||||
exe=`basename $i`
|
||||
case $exe in
|
||||
swtpm_setup.sh)
|
||||
cat >${WORKDIR}/swtpm_setup_oe.sh <<EOF
|
||||
#! /bin/sh
|
||||
#
|
||||
# Wrapper around swtpm_setup.sh which adds parameters required to
|
||||
@@ -21,19 +27,25 @@ export PATH
|
||||
# tcsd only allows to be run as root or tss. Pretend to be root...
|
||||
exec env ${FAKEROOTENV} ${FAKEROOTCMD} swtpm_setup.sh --config ${STAGING_DIR_NATIVE}/etc/swtpm_setup.conf "\$@"
|
||||
EOF
|
||||
|
||||
cat >${WORKDIR}/swtpm_cuse_oe.sh <<EOF
|
||||
;;
|
||||
swtpm_setup)
|
||||
true
|
||||
;;
|
||||
*)
|
||||
cat >${WORKDIR}/${exe}_oe.sh <<EOF
|
||||
#! /bin/sh
|
||||
#
|
||||
# Wrapper around swtpm_cuse which makes it easier to invoke
|
||||
# the right binary. Has to be run as root with TPM_PATH set
|
||||
# to a directory initialized as virtual TPM by swtpm_setup_oe.sh.
|
||||
# Wrapper around $exe which makes it easier to invoke
|
||||
# the right binary.
|
||||
|
||||
PATH="${bindir}:${base_bindir}:${sbindir}:${base_sbindir}:\$PATH"
|
||||
export PATH
|
||||
|
||||
exec swtpm_cuse "\$@"
|
||||
exec ${exe} "\$@"
|
||||
EOF
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
chmod a+rx ${WORKDIR}/*.sh
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user