mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-07-27 07:27:14 +00:00
Code Issues Projects Releases Wiki Activity

meta-integrity: Remove stale variables and documentation

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Stefan Berger
2024-06-19 10:15:53 -04:00
committed by Armin Kuster
parent 81d5a6edc7
commit d2d125de92
2 changed files with 1 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-integrity/README.md
+1 -6
View File
@@ -153,12 +153,7 @@ ima-evm-rootfs.bbclass:
IMA_EVM_KEY_DIR = "<full path>" IMA_EVM_KEY_DIR = "<full path>"
IMA_EVM_PRIVKEY = "<some other path/privkey_ima.pem>" IMA_EVM_PRIVKEY = "<some other path/privkey_ima.pem>"
By default, the entire file system gets signed. When using a policy which By default, the entire file system gets signed.
does not require that, the set of files to be labelled can be chosen
by overriding the default "find" expression, for example like this:
IMA_EVM_ROOTFS_FILES = "usr sbin bin lib -type f"
2. Usage 2. Usage
======== ========
meta-integrity/classes/ima-evm-rootfs.bbclass
-5
View File
@@ -19,11 +19,6 @@ IMA_EVM_X509 ?= "${IMA_EVM_KEY_DIR}/x509_ima.der"
# ima-local-ca.x509 is what ima-gen-local-ca.sh creates. # ima-local-ca.x509 is what ima-gen-local-ca.sh creates.
IMA_EVM_ROOT_CA ?= "${IMA_EVM_KEY_DIR}/ima-local-ca.pem" IMA_EVM_ROOT_CA ?= "${IMA_EVM_KEY_DIR}/ima-local-ca.pem"
# Sign all regular files by default.
IMA_EVM_ROOTFS_SIGNED ?= ". -type f"
# Hash nothing by default.
IMA_EVM_ROOTFS_HASHED ?= ". -depth 0 -false"
# Mount these file systems (identified via their mount point) with # Mount these file systems (identified via their mount point) with
# the iversion flags (needed by IMA when allowing writing). # the iversion flags (needed by IMA when allowing writing).
IMA_EVM_ROOTFS_IVERSION ?= "" IMA_EVM_ROOTFS_IVERSION ?= ""