linux/meta-security.git/meta-integrity/recipes-core, branch testMirror of git.yoctoproject.org/meta-security.githttps://git.enea.com/cgit/linux/meta-security.git/atom?h=test2021-04-12T14:07:11+00:00initramfs-framework-ima: introduce IMA_FORCE2021-04-12T14:07:11+00:00Ming Liuliu.ming50@gmail.com2021-04-08T18:38:14+00:00urn:sha1:076e75d5cc1fe7b43af8dcd10d8b2b18af422c84
Introduce IMA_FORCE to allow the IMA policy be applied forcely even
'no_ima' boot parameter is available.
This ensures the end users have a way to disable 'no_ima' support if
they want to, because it may expose a security risk if an attacker can
find a way to change kernel arguments, it will easily bypass rootfs
authenticity checks.
Signed-off-by: Sergio Prado <sergio.prado@toradex.com>
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
initramfs-framework-ima: let ima_enabled return 02021-02-24T04:34:51+00:00Ming Liuliu.ming50@gmail.com2021-02-20T12:18:21+00:00urn:sha1:ffab25f929d8e78a909e1a2b362c05be83dee4bf
Otherwise, ima script would not run as intended.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
initramfs-framework-ima: RDEPENDS on ima-evm-keys2021-02-24T04:34:51+00:00Ming Liuliu.ming50@gmail.com2021-02-20T12:18:18+00:00urn:sha1:52bfc654e8a48a1fcfd89ba8750021c21718f6f5
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
initramfs-framework-ima: fix a wrong path2021-02-24T04:34:51+00:00Ming Liuliu.ming50@gmail.com2021-02-20T12:18:16+00:00urn:sha1:0f34b25763de5286cb775f062942fe59eeef7f59
/etc/ima-policy > /etc/ima/ima-policy.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
meta-integrity: fix issues with yocto-check-layer2020-01-04T18:55:26+00:00Armin Kusterakuster808@gmail.com2019-12-22T15:43:00+00:00urn:sha1:5d629ccb542fe8ce523ea0a53d8a505552004302
[v2]
re-did solutions
Signed-off-by: Armin Kuster <akuster808@gmail.com>
initramfs-framework-ima: correct IMA_POLICY name2019-09-07T15:32:50+00:00Armin Kusterakuster808@gmail.com2019-09-01T15:13:18+00:00urn:sha1:225c3bc7d07cbfbcde6eb2d9df166a54f7560a21
it had ima_policy_hashed and did not match the recipe
ima-policy-hashed
found by yocto-check-layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
integrity-image: IMA_EVM_KEY_DIR has no affect, remove2019-08-25T03:43:55+00:00Armin Kusterakuster808@gmail.com2019-08-12T01:50:19+00:00urn:sha1:563c2af19c1c34bf0370be79f2b07afc25b0bdb7
Signed-off-by: Armin Kuster <akuster808@gmail.com>
meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASE2019-08-04T20:12:41+00:00Dmitry Eremin-Solenikovdmitry_eremin-solenikov@mentor.com2019-07-28T15:31:48+00:00urn:sha1:c9c4e6c228556cc2054a4b49f85b282fd69fc25c
data/debug-keys will be reused for demo modsign keys, so rename
IMA_EVM_BASE to more generic INTEGRITY_BASE.
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
image: add image for testing2019-05-28T14:38:52+00:00Armin Kusterakuster808@gmail.com2019-05-27T01:20:09+00:00urn:sha1:41708b0b0c32be7cf0387c595e0b03ad6b23ae4e
Signed-off-by: Armin Kuster <akuster808@gmail.com>
initramfs: clean up to pull in packages.2019-05-28T14:38:52+00:00Armin Kusterakuster808@gmail.com2019-05-26T18:28:57+00:00urn:sha1:7b287954f7f342f5e4ae8ba22063945bff0b607e
Signed-off-by: Armin Kuster <akuster808@gmail.com>