linux/meta-secure-core.git/meta-integrity/recipes-core/initrdscripts, branch thud

key-store: rename ima private key and certificate on target

2018-11-07T06:22:47+00:00

If sample keys are selected, key-store service will deploy IMA private key during first boot, but beople may be confused if we deploy a sample private key like "xxx.crt", so this commit is making sure key/cert on target are consistent with key files on build system. Signed-off-by: Yunguo Wei

meta-integrity, meta-signing-key: Populate the secondary keyring

2018-05-17T12:36:23+00:00

Currently we provide a secondary trusted key that is signed by the primary key. We do not however DER encode this certificate. Update the key-store recipe to also make a DER encoding of this certificate and include it in the same package as the PEM version of the certificate. In the IMA init script, if we have any secondary certificate in a DER encoding, load them into the secondary keyring before we try and load the IMA keys. Signed-off-by: Tom Rini

meta-integrity: init.ima: Switch to using keyctl

2018-05-17T12:36:23+00:00

Rather than parse /proc/keys directly to find out the ID of the keyring that we're using, let keyctl do this for us. In order to do that we need to have /proc available as /proc, so move it around before and after working with keyctl. Signed-off-by: Tom Rini

init.ima: Fix up the syntax error

2018-03-20T02:46:19+00:00

Signed-off-by: Jia Zhang

init.ima: Fix the failure when importing the external policy from real rootfs

2018-03-19T21:04:03+00:00

Signed-off-by: Jia Zhang

initrdscripts: rename expected ima certificate (#28)

2017-11-12T01:43:48+00:00

evmctl is able to import DER format certificate only. Although *.crt doesn't mean its a PEM certificate, but *.der makes more sense. Signed-off-by: Yunguo Wei

meta-secure-core: clean up ${COREBASE}/LICENSE and ${COREBASE}/meta/COPYING.MIT

2017-09-02T03:11:44+00:00

${COREBASE}/LICENSE is not a valid license file. So it is recommended to use '${COMMON_LICENSE_DIR}/MIT' for a MIT License file in LIC_FILES_CHKSUM. This will become an error in the future. Signed-off-by: Jia Zhang

init.ima: clean up and allow to load extra IMA policies from the real rootfs

2017-08-15T08:15:38+00:00

Signed-off-by: Lans Zhang

IMA: move the default policy file to /etc/ima directory

2017-07-25T01:37:59+00:00

Signed-off-by: Lans Zhang

Clean up RDEPENDS

2017-07-05T02:52:10+00:00

Signed-off-by: Lans Zhang