linux/meta-security.git/meta-integrity, branch walnascarMirror of git.yoctoproject.org/meta-security.githttps://git.enea.com/cgit/linux/meta-security.git/atom?h=walnascar2025-03-12T19:31:15+00:00meta-integrity: Enable choice of creating IMA signatures or hashes2025-03-12T19:31:15+00:00Stefan Bergerstefanb@linux.ibm.com2025-02-06T20:54:41+00:00urn:sha1:a76a5c51283b9d361caf514dc5cdebd72b5b4ca1
When IMA and EVM are used for file appraisal then EVM verifies the
signature stored in security.evm. This signature covers file metadata
(uid, gid, mode bits, etc.) as well as the security.ima xattr.
Therefore, it is sufficient that only files' hashes are stored in
security.ima. This also leads to slight performance improvements
since IMA appraisal will then only verify that a file's hash matches
the expected hash stored in security.ima. EVM will ensure that the
signature over all the file metadata and security.ima xattr is
correct. Therefore, give the user control over whether to store file
signatures (--imasig) in ima.security or hashes (--imahash) by
setting the option in IMA_EVM_IMA_XATTR_OPT.
Only test-verify an IMA signature if --imasig is used as the option.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
meta-security: Remove True option to getVar calls2025-02-03T02:11:12+00:00akash hadkeakash.hadke27@gmail.com2025-01-09T10:43:48+00:00urn:sha1:8fcbc47b9c56fe405a7a6d51ff0d8e2b756818ea
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.
Signed-off-by: Akash Hadke <akash.hadke27@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
oeqa runtime ima.py: skip without "integrity" in DISTRO_FEATURES2024-12-27T16:28:23+00:00Mikko Rapelimikko.rapeli@linaro.org2024-12-20T14:04:41+00:00urn:sha1:1f7cc51443cb6baa1de519df1a9c570b3f5cae2a
ima and meta-integrity are not enabled without and the test fails.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
layer.conf: Update to walnascar (5.2) layer/release series2024-11-25T01:15:36+00:00Armin Kusterakuster808@gmail.com2024-10-05T16:33:45+00:00urn:sha1:0055dfe35d98bcfb11cb649c89a868ad9c163497
Signed-off-by: Armin Kuster <akuster808@gmail.com>
layer.conf: Update to styhead release name series2024-09-15T15:27:10+00:00Armin Kusterakuster808@gmail.com2024-09-15T15:27:10+00:00urn:sha1:5e742d7fb09f63c558738dc9ec728dfdc624cec4
few more layers to fixup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
ima-policy: Fix S=UNPACKDIR2024-08-01T01:10:13+00:00Armin Kusterakuster808@gmail.com2024-07-29T23:59:28+00:00urn:sha1:03c0e8e03a6ff5633be47e0e2fb8c5021e6f5c96
Drop BP , these are files not src bundle
Signed-off-by: Armin Kuster <akuster808@gmail.com>
ima-policy-simple: set S2024-08-01T01:10:13+00:00Mikko Rapelimikko.rapeli@linaro.org2024-07-25T09:01:30+00:00urn:sha1:5a7efe2ed8584777ceaea862d7268ba08955a074
Build with latest poky fails without it
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
ima-policy-appraise-all: set S2024-08-01T01:10:13+00:00Mikko Rapelimikko.rapeli@linaro.org2024-07-25T09:01:29+00:00urn:sha1:7fd6a97183056d3f5eacc6a74fdd835359e4f9de
Build with latest poky requires it
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
ima-policy-hashed: set S2024-08-01T01:10:13+00:00Mikko Rapelimikko.rapeli@linaro.org2024-07-25T09:01:28+00:00urn:sha1:bcbe3fd60aa5b1d7d711b24b6ea72b5eee15a637
Build with latest poky fails without
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
ima-policy-simple: UNPACKDIR fix2024-08-01T01:10:13+00:00Mikko Rapelimikko.rapeli@linaro.org2024-07-25T09:01:20+00:00urn:sha1:139d3e64876383f637fc09e21f5b16d9669d8373
New poky uses UNPACKDIR instead of WORKDIR
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>