linux/meta-security.git/meta-integrity, branch test

initramfs-framework-ima: introduce IMA_FORCE

2021-04-12T14:07:11+00:00

Introduce IMA_FORCE to allow the IMA policy be applied forcely even 'no_ima' boot parameter is available. This ensures the end users have a way to disable 'no_ima' support if they want to, because it may expose a security risk if an attacker can find a way to change kernel arguments, it will easily bypass rootfs authenticity checks. Signed-off-by: Sergio Prado Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

meta: drop IMA_POLICY from policy recipes

2021-04-02T15:21:34+00:00

IMA_POLICY is being referred as policy recipe name in some places and it is also being referred as policy file in other places, they are conflicting with each other which make it impossible to set a IMA_POLICY global variable in config file. Fix it by dropping IMA_POLICY definitions from policy recipes Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

layer.conf: Add hardknott to LAYERSERIES_COMPAT

2021-03-18T15:01:19+00:00

Thats codename for 3.3 Signed-off-by: Armin Kuster

ima-evm-keys: add file-checksums to IMA_EVM_X509

2021-03-18T15:01:19+00:00

This ensures when a end user change the IMA_EVM_X509 key file, ima-evm-keys recipe will be rebuilt. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagic

2021-03-02T19:56:27+00:00

This fixes following systemd boot issues: [ 7.455580] systemd[1]: Failed to create /init.scope control group: Permission denied [ 7.457677] systemd[1]: Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object. [ 7.459270] systemd[1]: Freezing execution. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wic

2021-02-24T04:34:51+00:00

Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

initramfs-framework-ima: let ima_enabled return 0

2021-02-24T04:34:51+00:00

Otherwise, ima script would not run as intended. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

README.md: update according to the refactoring in ima-evm-rootfs.bbclass

2021-02-24T04:34:51+00:00

Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

meta: refactor IMA/EVM sign rootfs

2021-02-24T04:34:51+00:00

The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu Signed-off-by: Armin Kuster

initramfs-framework-ima: RDEPENDS on ima-evm-keys

2021-02-24T04:34:51+00:00

Signed-off-by: Ming Liu Signed-off-by: Armin Kuster