summaryrefslogtreecommitdiffstats
path: root/meta-integrity/classes
Commit message (Collapse)AuthorAgeFilesLines
* ima,evm: Add two variables to write filenames and signatures intoStefan Berger2023-11-081-0/+12
| | | | | | | | | | | | | | | | | | | | Add two variables IMA_FILE_SIGNATURES_FILE and EVM_FILE_SIGNATURES_FILE for filenames where the ima_evm_sign_rootfs script can write the names of files and their IMA or EVM signatures into. Both variables are optional. The content of the file with IMA signatures may look like this: /usr/bin/gpiodetect ima:0x0302046730eefd... /usr/bin/pwscore ima:0x0302046730eefd004... Having the filenames along with their signatures is useful for signing files in the initrd when the initrd is running out of a tmpfs filesystem that has support for xattrs. This allows to enable an IMA appraisal policy already in the initrd where files must be signed as soon as the policy becomes active. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Sign all executables and the ima-policy in the root filesystemStefan Berger2023-05-061-5/+20
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICYStefan Berger2023-05-061-2/+2
| | | | | | | | | The IMA policy will be specified using the IMA_EVM_POLICY variable since systemd will not be involved in loading the policy but the init script will load it. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the IMA kernel featureStefan Berger2023-05-061-1/+4
| | | | | | | | Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: kernel-modsign: prevents splitting out debug symbolsJose Quaresma2022-07-051-0/+2
| | | | | | | | | | Starting with [1] kernel modules symbols is being slipped in OE-core and this breaks the kernel modules sign, so disable it. [1] https://git.openembedded.org/openembedded-core/commit/?id=e09a8fa931fe617afc05bd5e00dca5dd3fe386e8 Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: kernel-modsign: Change weak default valueDaiane Angolini2021-08-261-1/+1
| | | | | | | | Assign a weak default value for MODSIGN_KEY_DIR so the other layers can set a default value for them as well. Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Convert to new override syntaxArmin Kuster2021-08-012-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: add sanity checkArmin Kuster2021-06-061-0/+10
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wicMing Liu2021-02-231-0/+3
| | | | | | | Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: refactor IMA/EVM sign rootfsMing Liu2021-02-231-18/+12
| | | | | | | | | | | | | | | | | | | | | | | | | The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kernel-modsign.bbclass: add support for kernel modules signingDmitry Eremin-Solenikov2019-08-071-0/+29
| | | | | | | | | | Add bbclass responsible for handling signing of kernel modules. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> fixup class to avoid including in every configure task Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASEDmitry Eremin-Solenikov2019-08-041-1/+1
| | | | | | | data/debug-keys will be reused for demo modsign keys, so rename IMA_EVM_BASE to more generic INTEGRITY_BASE. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* meta-integrity: port over from meta-intel-iot-securityArmin Kuster2019-05-281-0/+92
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 11:21:50 +0000