mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-07-26 19:17:08 +00:00
Code Issues Projects Releases Wiki Activity

meta-integrity: Enable choice of creating IMA signatures or hashes

Browse Source 
When IMA and EVM are used for file appraisal then EVM verifies the
signature stored in security.evm. This signature covers file metadata
(uid, gid, mode bits, etc.) as well as the security.ima xattr.
Therefore, it is sufficient that only files' hashes are stored in
security.ima. This also leads to slight performance improvements
since IMA appraisal will then only verify that a file's hash matches
the expected hash stored in security.ima. EVM will ensure that the
signature over all the file metadata and security.ima xattr is
correct. Therefore, give the user control over whether to store file
signatures (--imasig) in ima.security or hashes (--imahash) by
setting the option in IMA_EVM_IMA_XATTR_OPT.

Only test-verify an IMA signature if --imasig is used as the option.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Stefan Berger
2025-02-06 15:54:41 -05:00
committed by Armin Kuster
parent 7307755636
commit a76a5c5128
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-integrity/README.md
+1
View File
@@ -97,6 +97,7 @@ the image, enable image signing in the local.conf like this:
IMA_EVM_PRIVKEY = "${IMA_EVM_KEY_DIR}/privkey_ima.pem"
IMA_EVM_EVMCTL_KEY_PASSWORD = "<optional private key password>"
IMA_EVM_PRIVKEY_KEYID_OPT = "<options to use while signing>"
IMA_EVM_IMA_XATTR_OPT = "<whether to sign or hash for IMA>"
IMA_EVM_X509 = "${IMA_EVM_KEY_DIR}/x509_ima.der"
IMA_EVM_ROOT_CA = "${IMA_EVM_KEY_DIR}/ima-local-ca.pem"