mirror of
https://git.yoctoproject.org/meta-security
synced 2026-04-20 23:40:05 +00:00
linux: update bbappend
remove untested code Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Armin Kuster
@@ -1,116 +1,3 @@
|
||||
IMA_ENABLED_HERE := "${@'yes' if bb.data.inherits_class('kernel', d) and 'ima' in d.getVar('DISTRO_FEATURES', True).split() else 'no'}"
|
||||
FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
|
||||
|
||||
IMA_FILESEXTRAPATHS_yes := "${THISDIR}/linux:"
|
||||
IMA_FILESEXTRAPATHS_no := ""
|
||||
FILESEXTRAPATHS_prepend := "${IMA_FILESEXTRAPATHS_${IMA_ENABLED_HERE}}"
|
||||
|
||||
# These two patches are necessary to unpack archives with security.ima xattr
|
||||
# such that security.ima is taken from the archive. If the policy
|
||||
# allows hashing, unpatched kernels (at least up to 4.3) will replace
|
||||
# a signed hash in security.ima with a locally computed hash.
|
||||
#
|
||||
# Note that only bsdtar/libarchive are known to work; GNU tar sets
|
||||
# the security.ima on an empty file and the tries re-opening it for
|
||||
# writing its content, which then fails due to the IMA hash mismatch.
|
||||
#
|
||||
# Kernels >= 4.7 have the patches, while older kernels are likely to
|
||||
# need the patches. So apply them by default. To avoid that,
|
||||
# set IMA_EVM_SETATTR_PATCH_x.y.z (where x.y.z == linux kernel version)
|
||||
# to an empty string (to avoid patching) or some other patch files
|
||||
# suitable for that kernel.
|
||||
def ima_evm_setattr_patch(d):
|
||||
result = []
|
||||
linux_version = d.getVar('LINUX_VERSION', True) or ''
|
||||
# These two patches are known to be included upstream.
|
||||
if bb.utils.vercmp_string_op(linux_version, '4.7', '<'):
|
||||
patches = d.getVar('IMA_EVM_SETATTR_PATCH_' + linux_version, True)
|
||||
if patches != None:
|
||||
# Patches explicitly chosen, may be empty.
|
||||
result.append(patches)
|
||||
else:
|
||||
# Enabled by default.
|
||||
result.append('file://0001-ima-fix-ima_inode_post_setattr.patch file://0002-ima-add-support-for-creating-files-using-the-mknodat.patch')
|
||||
# This one addresses a problem added in 4.2. The upstream revert will land
|
||||
# in some future kernel. We need to extend version check once we know
|
||||
# which kernels have the patch.
|
||||
if bb.utils.vercmp_string_op(linux_version, '4.2', '>='):
|
||||
patches = d.getVar('IMA_EVM_SETATTR_REVERT_PATCH_' + linux_version, True)
|
||||
if patches != None:
|
||||
# Patches explicitly chosen, may be empty.
|
||||
result.append(patches)
|
||||
else:
|
||||
# Enabled by default.
|
||||
result.append('file://Revert-ima-limit-file-hash-setting-by-user-to-fix-an.patch')
|
||||
return ' '.join(result)
|
||||
|
||||
# Edison kernel too old, patch not applicable -> swupd is broken in Ostro OS for Edison.
|
||||
IMA_EVM_SETATTR_PATCH_3.10.98 = ""
|
||||
|
||||
# Kernel config fragment enabling IMA/EVM and (where necessary and possible)
|
||||
# also patching the kernel.
|
||||
IMA_EVM_CFG_yes = " file://ima.cfg \
|
||||
${@ ima_evm_setattr_patch(d)} \
|
||||
"
|
||||
IMA_EVM_CFG_no = ""
|
||||
SRC_URI_append = "${IMA_EVM_CFG_${IMA_ENABLED_HERE}}"
|
||||
|
||||
# IMA_EVM_ROOT_CA, if set, is the absolute path to a der-encoded
|
||||
# x509 CA certificate which will get compiled into the kernel.
|
||||
# The kernel will then use it to validate additional certificates,
|
||||
# like the one loaded dynamically for IMA.
|
||||
#
|
||||
# Depending on the kernel version, there are two ways to add the
|
||||
# CA certificate:
|
||||
# - For Linux < 4.3, we put the x509 file into the source directory
|
||||
# where the kernel compilation will find it automatically
|
||||
# (http://lxr.free-electrons.com/source/kernel/Makefile?v=4.2#L115).
|
||||
# - For Linux >= 4.3, we set SYSTEM_TRUSTED_KEYS
|
||||
# (http://lxr.free-electrons.com/source/certs/Kconfig?v=4.3#L29).
|
||||
# The ima_evm_root_ca.cfg only contains a blank file name.
|
||||
# The actual file name gets patched in after the file was used
|
||||
# to configure the kernel (see do_kernel_configme_append).
|
||||
# This has to point to a single file, i.e. using it for IMA has to
|
||||
# be coordinated with other usages.
|
||||
#
|
||||
# The IMA_EVM_ROOT_CA default is set globally in ima-evm-rootfs.bbclass.
|
||||
# Need weaker default here in case that ima-evm-rootfs.bbclass is not
|
||||
# inherited.
|
||||
IMA_EVM_ROOT_CA ??= ""
|
||||
|
||||
# Add CONFIG_SYSTEM_TRUSTED_KEYS (for recent kernels) and
|
||||
# copy the root certificate into the build directory. By using
|
||||
# the normal fetcher mechanism for the certificate we ensure that
|
||||
# a rebuild is triggered when the file name or content change.
|
||||
#
|
||||
# Recompiling on name change is a bit too aggressive and causes
|
||||
# unnecessary rebuilds when only the location of the file, but not its
|
||||
# content change. This may need further work, should it become a problem
|
||||
# in practice. For example, IMA_EVM_ROOT_CA could be redefined as
|
||||
# an URL that then gets found via the normal file lookup.
|
||||
#
|
||||
# The fetcher does not expand SRC_URI. We have to enforce that here.
|
||||
IMA_EVM_ROOT_CA_CFG_yes = "${@ \
|
||||
((' file://ima_evm_root_ca.cfg' if bb.utils.vercmp_string_op('${LINUX_VERSION}', '4.3', '>=') else '') + \
|
||||
' file://${IMA_EVM_ROOT_CA}') \
|
||||
if '${IMA_EVM_ROOT_CA}' else ''}"
|
||||
IMA_EVM_ROOT_CA_CFG_no = ""
|
||||
|
||||
SRC_URI_append = "${IMA_EVM_ROOT_CA_CFG_${IMA_ENABLED_HERE}}"
|
||||
|
||||
do_kernel_configme_append () {
|
||||
if [ '${IMA_EVM_ROOT_CA}' ] && grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS=' ${B}/.config; then
|
||||
# We can replace a blank value from ima_evm_root_ca.cfg,
|
||||
# but when we find some other value, then we have to abort
|
||||
# because we can't set more than one value.
|
||||
eval `grep '^CONFIG_SYSTEM_TRUSTED_KEYS='`
|
||||
if [ "$CONFIG_SYSTEM_TRUSTED_KEYS" ] && [ "$CONFIG_SYSTEM_TRUSTED_KEYS" != "${IMA_EVM_ROOT_CA}" ]; then
|
||||
bbfatal "CONFIG_SYSTEM_TRUSTED_KEYS already set to $CONFIG_SYSTEM_TRUSTED_KEYS, cannot replace with IMA_EVM_ROOT_CA = ${IMA_EVM_ROOT_CA}"
|
||||
exit 1
|
||||
fi
|
||||
pemcert=${B}/`basename ${IMA_EVM_ROOT_CA}`.pem
|
||||
openssl x509 -inform der -in ${IMA_EVM_ROOT_CA} -out $pemcert
|
||||
sed -i -e "s;^CONFIG_SYSTEM_TRUSTED_KEYS=.*;CONFIG_SYSTEM_TRUSTED_KEYS=\"$pemcert\";" ${B}/.config
|
||||
fi
|
||||
}
|
||||
|
||||
do_kernel_configme[depends] += "${@ 'openssl-native:do_populate_sysroot' if '${IMA_ENABLED_HERE}' == 'yes' and '${IMA_EVM_ROOT_CA}' else '' }"
|
||||
SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' file://ima.cfg', '', d)}"
|
||||
|
||||
Reference in New Issue
Block a user