mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-06-02 13:30:33 +00:00
Code Issues Projects Releases Wiki Activity

ima-evm-utils: Update to 1.4

Browse Source 
Switch from git to https in SRC_URI
Drop patches not upstreamed.

Passes OEQA:
RESULTS - ima.IMACheck.test_ima_enabled: PASSED (1.05s)
RESULTS - ima.IMACheck.test_ima_hash: PASSED (6.13s)
RESULTS - ima.IMACheck.test_ima_overwrite: PASSED (131.31s)
RESULTS - ima.IMACheck.test_ima_signature: PASSED (69.03s)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Armin Kuster
2022-05-18 09:57:21 -07:00
parent a8fba7a8ef
commit 8e59bd9e0a
4 changed files with 2 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch
-68
View File
@@ -1,68 +0,0 @@
From 5834216fb3aa4e5e59ee13e871c70db1b4e13f02 Mon Sep 17 00:00:00 2001
From: Patrick Ohly <patrick.ohly@intel.com>
Date: Fri, 30 Sep 2016 10:22:16 +0200
Subject: [PATCH] command line: apply operation to all paths
Previously, invocations like "evmctl ima_hash foo bar" silently
ignored all parameters after the first path name ("foo" in this
example).
Now evmctl iterates over all specified paths. It aborts with an
error as soon as the selected operation fails for a path.
Supporting more than one parameter is useful in combination with
"find" and "xargs" because it is noticably faster than invoking
evmutil separately for each file, in particular when run under pseudo
(a fakeroot environment used by the OpenEmbedded build system).
This complements the recursive mode and can be used when more control
over file selection is needed.
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
---
src/evmctl.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/src/evmctl.c b/src/evmctl.c
index 23cf54c..2072034 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -626,7 +626,7 @@ static int get_file_type(const char *path, const char *search_type)
static int do_cmd(struct command *cmd, find_cb_t func)
{
char *path = g_argv[optind++];
- int err, dts = REG_MASK; /* only regular files by default */
+ int err = 0, dts = REG_MASK; /* only regular files by default */
if (!path) {
log_err("Parameters missing\n");
@@ -634,15 +634,18 @@ static int do_cmd(struct command *cmd, find_cb_t func)
return -1;
}
- if (recursive) {
- if (search_type) {
- dts = get_file_type(path, search_type);
- if (dts < 0)
- return dts;
+ while (path && !err) {
+ if (recursive) {
+ if (search_type) {
+ dts = get_file_type(path, search_type);
+ if (dts < 0)
+ return dts;
+ }
+ err = find(path, dts, func);
+ } else {
+ err = func(path);
}
- err = find(path, dts, func);
- } else {
- err = func(path);
+ path = g_argv[optind++];
}
return err;
--
2.1.4
meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch
-50
View File
@@ -1,50 +0,0 @@
From 321a602098d11ee712ebd01f51033b5fd369eae9 Mon Sep 17 00:00:00 2001
From: Patrick Ohly <patrick.ohly@intel.com>
Date: Wed, 13 May 2015 03:41:02 -0700
Subject: [PATCH] Makefile.am: disable man page creation
Depends on asciidoc, which is not available.
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
---
Makefile.am | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/Makefile.am b/Makefile.am
index 06ebf59..4ddd52c 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,5 +1,5 @@
SUBDIRS = src
-dist_man_MANS = evmctl.1
+# dist_man_MANS = evmctl.1
doc_DATA = examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh
EXTRA_DIST = autogen.sh $(doc_DATA)
@@ -39,4 +39,21 @@ rmman:
doc: evmctl.1.html rmman evmctl.1
+# requires asciidoc, xslproc, docbook-xsl
+# FIXME Disabled until docbook-xsl is unavaliable on tizen.org
+#MANPAGE_DOCBOOK_XSL = /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl
+#
+#evmctl.1.html: README
+# @asciidoc -o $@ $<
+#
+#evmctl.1:
+# asciidoc -d manpage -b docbook -o evmctl.1.xsl README
+# xsltproc --nonet -o $@ $(MANPAGE_DOCBOOK_XSL) evmctl.1.xsl
+# rm -f evmctl.1.xsl
+#
+#rmman:
+# rm -f evmctl.1
+#
+#doc: evmctl.1.html rmman evmctl.1
+
.PHONY: $(tarname)
--
1.8.4.5
meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
-47
View File
@@ -1,47 +0,0 @@
From 2dec9199f8a8a2c84b25a3d3e7e2f41b71e07834 Mon Sep 17 00:00:00 2001
From: Patrick Ohly <patrick.ohly@intel.com>
Date: Wed, 17 Jun 2015 14:28:18 +0200
Subject: [PATCH 20/20] evmctl.c: do not depend on xattr.h with IMA defines
Compilation on older Linux distros (like Ubuntu 12.04) fails
because linux/xattr.h does not yet have the IMA defines. Compiling
there makes sense when only the tools are needed, for example when
signing an image in cross-compile mode.
To support this, add fallbacks for the two defines which are needed.
Their value is part of the Linux ABI and thus fixed.
Upstream-status: Submitted [linux-ima-devel@lists.sourceforge.net]
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
---
src/evmctl.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/evmctl.c b/src/evmctl.c
index c54efbb..23cf54c 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -57,6 +57,18 @@
#include <termios.h>
#include <assert.h>
+/*
+ * linux/xattr.h might be old to have this. Allow compilation on older
+ * Linux distros (like Ubuntu 12.04) by falling back to our own
+ * definition.
+ */
+#ifndef XATTR_IMA_SUFFIX
+# define XATTR_IMA_SUFFIX "ima"
+#endif
+#ifndef XATTR_NAME_IMA
+# define XATTR_NAME_IMA XATTR_SECURITY_PREFIX XATTR_IMA_SUFFIX
+#endif
+
#include <openssl/sha.h>
#include <openssl/pem.h>
#include <openssl/hmac.h>
--
2.1.4
meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb → meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_1.4.bb
+2 -16
View File
@@ -6,22 +6,8 @@ DEPENDS += "openssl attr keyutils"
DEPENDS:class-native += "openssl-native keyutils-native" DEPENDS:class-native += "openssl-native keyutils-native"
PV = "1.2.1+git${SRCPV}" SRC_URI = "https://sourceforge.net/projects/linux-ima/files/${BPN}/${BP}.tar.gz"
SRCREV = "3eab1f93b634249c1720f65fcb495b1996f0256e" SRC_URI[sha256sum] = "fcf85b31d6292051b3679e5f17ffa7f89b6898957aad0f59aa4e9878884b27d1"
SRC_URI = "git://git.code.sf.net/p/linux-ima/ima-evm-utils;branch=ima-evm-utils-1.2.y"
# Documentation depends on asciidoc, which we do not have, so
# do not build documentation.
SRC_URI += "file://disable-doc-creation.patch"
# Workaround for upstream incompatibility with older Linux distros.
# Relevant for us when compiling ima-evm-utils-native.
SRC_URI += "file://evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch"
# Required for xargs with more than one path as argument (better for performance).
SRC_URI += "file://command-line-apply-operation-to-all-paths.patch"
S = "${WORKDIR}/git"
inherit pkgconfig autotools features_check inherit pkgconfig autotools features_check