linux/meta-security.git, branch gatesgarth

ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagic

2021-03-04T21:09:24+00:00

This fixes following systemd boot issues: [ 7.455580] systemd[1]: Failed to create /init.scope control group: Permission denied [ 7.457677] systemd[1]: Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object. [ 7.459270] systemd[1]: Freezing execution. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wic

2021-03-04T21:09:03+00:00

Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

initramfs-framework-ima: let ima_enabled return 0

2021-03-04T21:09:03+00:00

Otherwise, ima script would not run as intended. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

README.md: update according to the refactoring in ima-evm-rootfs.bbclass

2021-03-04T21:09:03+00:00

Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

meta: refactor IMA/EVM sign rootfs

2021-03-04T21:09:03+00:00

The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

initramfs-framework-ima: RDEPENDS on ima-evm-keys

2021-03-04T21:09:03+00:00

Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

ima-evm-keys: add recipe

2021-03-04T21:09:03+00:00

Create a recipe to package IMA/EMV public keys. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

initramfs-framework-ima: fix a wrong path

2021-03-04T21:09:03+00:00

/etc/ima-policy > /etc/ima/ima-policy. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

ima-evm-utils: set native REQUIRED_DISTRO_FEATURES to empty

2021-03-04T21:08:50+00:00

'ima' does not have to be in native DISTRO_FEATURES, unset it to avoid sanity check for ima-evm-utils-native. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

kas-security-base: use gatesgarth name

2021-02-25T05:22:22+00:00

drop DL_DIR Signed-off-by: Armin Kuster