summaryrefslogtreecommitdiffstats
path: root/meta-integrity/classes
Commit message (Collapse)AuthorAgeFilesLines
* ima: Sign all executables and the ima-policy in the root filesystemStefan Berger2023-05-061-5/+20
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICYStefan Berger2023-05-061-2/+2
| | | | | | | | | The IMA policy will be specified using the IMA_EVM_POLICY variable since systemd will not be involved in loading the policy but the init script will load it. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the IMA kernel featureStefan Berger2023-05-061-1/+4
| | | | | | | | Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: kernel-modsign: prevents splitting out debug symbolsJose Quaresma2022-07-051-0/+2
| | | | | | | | | | Starting with [1] kernel modules symbols is being slipped in OE-core and this breaks the kernel modules sign, so disable it. [1] https://git.openembedded.org/openembedded-core/commit/?id=e09a8fa931fe617afc05bd5e00dca5dd3fe386e8 Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: kernel-modsign: Change weak default valueDaiane Angolini2021-08-261-1/+1
| | | | | | | | Assign a weak default value for MODSIGN_KEY_DIR so the other layers can set a default value for them as well. Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Convert to new override syntaxArmin Kuster2021-08-012-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: add sanity checkArmin Kuster2021-06-061-0/+10
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wicMing Liu2021-02-231-0/+3
| | | | | | | Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: refactor IMA/EVM sign rootfsMing Liu2021-02-231-18/+12
| | | | | | | | | | | | | | | | | | | | | | | | | The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kernel-modsign.bbclass: add support for kernel modules signingDmitry Eremin-Solenikov2019-08-071-0/+29
| | | | | | | | | | Add bbclass responsible for handling signing of kernel modules. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> fixup class to avoid including in every configure task Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASEDmitry Eremin-Solenikov2019-08-041-1/+1
| | | | | | | data/debug-keys will be reused for demo modsign keys, so rename IMA_EVM_BASE to more generic INTEGRITY_BASE. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* meta-integrity: port over from meta-intel-iot-securityArmin Kuster2019-05-281-0/+92
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 08:41:26 +0000