linux/meta-security.git/meta-integrity/classes, branch walnascar

meta-integrity: Enable choice of creating IMA signatures or hashes

2025-03-12T19:31:15+00:00

When IMA and EVM are used for file appraisal then EVM verifies the signature stored in security.evm. This signature covers file metadata (uid, gid, mode bits, etc.) as well as the security.ima xattr. Therefore, it is sufficient that only files' hashes are stored in security.ima. This also leads to slight performance improvements since IMA appraisal will then only verify that a file's hash matches the expected hash stored in security.ima. EVM will ensure that the signature over all the file metadata and security.ima xattr is correct. Therefore, give the user control over whether to store file signatures (--imasig) in ima.security or hashes (--imahash) by setting the option in IMA_EVM_IMA_XATTR_OPT. Only test-verify an IMA signature if --imasig is used as the option. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

meta-security: Remove True option to getVar calls

2025-02-03T02:11:12+00:00

getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke Signed-off-by: Armin Kuster

meta-integrity: Enable passing private key password

2024-07-01T11:07:58+00:00

Allow users to pass the private key password using IMA_EVM_EVMCTL_KEY_PASSWORD. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

meta-integrity: Add IMA_EVM_PRIVKEY_KEY_OPT to pass options to evmctl

2024-07-01T11:07:58+00:00

Introduce IMA_EVM_PRIVKEY_KEY_OPT to pass additional options to evmctl when signing files. An example is --keyid that makes evmctl use a specific key id when signing files. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

meta-integrity: Remove stale variables and documentation

2024-07-01T11:07:58+00:00

Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima,evm: Add two variables to write filenames and signatures into

2023-11-08T12:09:28+00:00

Add two variables IMA_FILE_SIGNATURES_FILE and EVM_FILE_SIGNATURES_FILE for filenames where the ima_evm_sign_rootfs script can write the names of files and their IMA or EVM signatures into. Both variables are optional. The content of the file with IMA signatures may look like this: /usr/bin/gpiodetect ima:0x0302046730eefd... /usr/bin/pwscore ima:0x0302046730eefd004... Having the filenames along with their signatures is useful for signing files in the initrd when the initrd is running out of a tmpfs filesystem that has support for xattrs. This allows to enable an IMA appraisal policy already in the initrd where files must be signed as soon as the policy becomes active. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima: Sign all executables and the ima-policy in the root filesystem

2023-05-06T11:54:09+00:00

Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICY

2023-05-06T11:54:09+00:00

The IMA policy will be specified using the IMA_EVM_POLICY variable since systemd will not be involved in loading the policy but the init script will load it. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima: Fix the IMA kernel feature

2023-05-06T11:54:09+00:00

Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

meta-integrity: kernel-modsign: prevents splitting out debug symbols

2022-07-05T23:26:50+00:00

Starting with [1] kernel modules symbols is being slipped in OE-core and this breaks the kernel modules sign, so disable it. [1] https://git.openembedded.org/openembedded-core/commit/?id=e09a8fa931fe617afc05bd5e00dca5dd3fe386e8 Signed-off-by: Jose Quaresma Signed-off-by: Armin Kuster