diff options
| author | Ming Liu <liu.ming50@gmail.com> | 2021-02-20 13:18:19 +0100 |
|---|---|---|
| committer | Armin Kuster <akuster808@gmail.com> | 2021-02-23 20:34:51 -0800 |
| commit | 76d1e3ecad77ecd38c1c99171d5f2497d1258644 (patch) | |
| tree | 136c77e18e80dd3af42403e7a69008a22ff8c805 /recipes-python | |
| parent | 52bfc654e8a48a1fcfd89ba8750021c21718f6f5 (diff) | |
| download | meta-security-76d1e3ecad77ecd38c1c99171d5f2497d1258644.tar.gz | |
meta: refactor IMA/EVM sign rootfs
The current logic in ima-evm-rootfs.bbclass does not guarantee
ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND
by appending to it, for instance, if there are other "_append" being
used as it's the case in openembedded-core/meta/classes/image.bbclass:
| IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \
| if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \
| and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True,
| False, d) else ''} reproducible_final_image_task; "
and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT
since that would impact all recipes but not only image recipes.
To fix the above issues, we introduce a ima_evm_sign_handler setting
IMA/EVM rootfs signing requirements/dependencies in event
bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if
IMA/EVM rootfs signing logic should be applied or not.
Also add ima-evm-keys to IMAGE_INSTALL.
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'recipes-python')
0 files changed, 0 insertions, 0 deletions