mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-05-06 16:48:42 +00:00
Code Issues Projects Releases Wiki Activity

ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICY

Browse Source 
The IMA policy will be specified using the IMA_EVM_POLICY variable since
systemd will not be involved in loading the policy but the init script will
load it.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Stefan Berger
2023-04-28 08:23:12 -04:00
committed by Armin Kuster
parent f4f7624d2e
commit 292b49342c
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta-integrity/README.md
View File

@@ -187,7 +187,7 @@ IMA policy loading became broken in systemd 2.18. The modified systemd
changes. To activate policy loading via systemd, place a policy file changes. To activate policy loading via systemd, place a policy file
in `/etc/ima/ima-policy`, for example with: in `/etc/ima/ima-policy`, for example with:
IMA_EVM_POLICY_SYSTEMD = "${INTEGRITY_BASE}/data/ima_policy_simple" IMA_EVM_POLICY = "${INTEGRITY_BASE}/data/ima_policy_simple"
To check that measuring works, look at `/sys/kernel/security/ima/ascii_runtime_measurements` To check that measuring works, look at `/sys/kernel/security/ima/ascii_runtime_measurements`

4
meta-integrity/classes/ima-evm-rootfs.bbclass
View File

@@ -69,10 +69,10 @@ ima_evm_sign_rootfs () {
find ${IMA_EVM_ROOTFS_HASHED} | xargs -d "\n" --no-run-if-empty --verbose evmctl ima_hash find ${IMA_EVM_ROOTFS_HASHED} | xargs -d "\n" --no-run-if-empty --verbose evmctl ima_hash
# Optionally install custom policy for loading by systemd. # Optionally install custom policy for loading by systemd.
if [ "${IMA_EVM_POLICY_SYSTEMD}" ]; then if [ "${IMA_EVM_POLICY}" ]; then
install -d ./${sysconfdir}/ima install -d ./${sysconfdir}/ima
rm -f ./${sysconfdir}/ima/ima-policy rm -f ./${sysconfdir}/ima/ima-policy
install "${IMA_EVM_POLICY_SYSTEMD}" ./${sysconfdir}/ima/ima-policy install "${IMA_EVM_POLICY}" ./${sysconfdir}/ima/ima-policy
fi fi
} }