mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-01-11 15:00:34 +00:00
Code Issues Projects Releases Wiki Activity

meta-integrity: Enable passing private key password

Browse Source 
Allow users to pass the private key password using
IMA_EVM_EVMCTL_KEY_PASSWORD.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Stefan Berger
2024-06-19 10:15:55 -04:00
committed by Armin Kuster
parent 06bd46276f
commit 37e5a930d7
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta-integrity/README.md
View File

@@ -95,6 +95,7 @@ the image, enable image signing in the local.conf like this:
IMA_EVM_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys"
IMA_EVM_PRIVKEY = "${IMA_EVM_KEY_DIR}/privkey_ima.pem"
IMA_EVM_EVMCTL_KEY_PASSWORD = "<optional private key password>"
IMA_EVM_PRIVKEY_KEYID_OPT = "<options to use while signing>"
IMA_EVM_X509 = "${IMA_EVM_KEY_DIR}/x509_ima.der"
IMA_EVM_ROOT_CA = "${IMA_EVM_KEY_DIR}/ima-local-ca.pem"

5
meta-integrity/classes/ima-evm-rootfs.bbclass
View File

@@ -12,6 +12,9 @@ IMA_EVM_PRIVKEY ?= "${IMA_EVM_KEY_DIR}/privkey_ima.pem"
# --keyid <id> or --keyid-from-cert <filename>.
IMA_EVM_PRIVKEY_KEYID_OPT ?= ""
# Password for the private key
IMA_EVM_EVMCTL_KEY_PASSWORD ?= ""
# Public part of certificates (used for both IMA and EVM).
# The default is okay when using the example key directory.
IMA_EVM_X509 ?= "${IMA_EVM_KEY_DIR}/x509_ima.der"
@@ -72,6 +75,8 @@ ima_evm_sign_rootfs () {
exit 1
fi
export EVMCTL_KEY_PASSWORD=${IMA_EVM_EVMCTL_KEY_PASSWORD}
bbnote "IMA/EVM: Signing root filesystem at ${IMAGE_ROOTFS} with key ${IMA_EVM_PRIVKEY}"
evmctl sign --imasig ${evmctl_param} --portable -a sha256 \
--key "${IMA_EVM_PRIVKEY}" ${IMA_EVM_PRIVKEY_KEYID_OPT} -r "${IMAGE_ROOTFS}"