dracut/0058-Define-new-script-to-load-keys-on-the-IMA-keyring-up.patch

From 41ac16b26fe05c8291d3467b8a7bee1bc2445393 Mon Sep 17 00:00:00 2001
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
Date: Wed, 29 Apr 2015 11:05:25 -0400
Subject: [PATCH] Define new script to load keys on the IMA keyring (update)

This patch supports loading keys either on the _ima keyring or, as of
Linux 3.17, on the trusted .ima keyring.  Only certificates signed by
a key on the system keyring can be loaded onto the trusted .ima keyring.

Changelog:
- Update 98integrity/README
---
 modules.d/98integrity/README           | 28 +++++++++++++++
 modules.d/98integrity/ima-keys-load.sh | 62 ++++++++++++++++++++++++++++++++++
 modules.d/98integrity/module-setup.sh  |  2 ++
 3 files changed, 92 insertions(+)
 create mode 100755 modules.d/98integrity/ima-keys-load.sh

diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
index d74e063..64de0ae 100644
--- a/modules.d/98integrity/README
+++ b/modules.d/98integrity/README
@@ -38,3 +38,31 @@ line.
 ------------- '/etc/sysconfig/ima' (with the default value) -------------
 IMAPOLICY="/etc/sysconfig/ima-policy"
 -------------------------------------------------------------------------
+
+
+# Information on loading distro, third party or local keys on the trusted IMA keyring
+
+# Loading distro, third party or local keys on the trusted IMA keyring requires
+# creating a local certificate authority(local-CA), installing the local-CA's
+# public key on the system-keyring and signing the certificates with the local-CA
+# key.
+#
+# Many directions for creating a mini certificate authority exist on the web
+# (eg. openssl, yubikey). (Reminder: safely storing the private key offline is
+# really important, especially in the case of the local-CA's private key.) The
+# local-CA's public key can be loaded onto the system keyring either by building
+# the key into the kernel or, on Fedora, storing it in the UEFI/Mok keyring. (As
+# of writing, the patches for loading the UEFI/Mok keys on the system-keyring
+# have not been upstreamed.)
+#
+# To view the system keyring: keyctl show %keyring:.system_keyring
+#
+# Most on-line directions for signing certificates requires creating a Certificate
+# Signing Request (CSR).  Creating such a request requires access to the private
+# key, which would not be available when signing distro or 3rd party certificates.
+# Openssl provides the "-ss_cert" option for directly signing certificates.
+
+# 98integrity/ima-keys-load.sh script loads the signed certificates stored 
+# in the $IMAKEYSDIR onto the trusted IMA keyring.  The default $IMAKEYSDIR
+# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
+# policy.
diff --git a/modules.d/98integrity/ima-keys-load.sh b/modules.d/98integrity/ima-keys-load.sh
new file mode 100755
index 0000000..659b722
--- /dev/null
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+SECURITYFSDIR="/sys/kernel/security"
+IMASECDIR="${SECURITYFSDIR}/ima"
+IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+
+load_x509_keys()
+{
+    KEYRING_ID=$1
+
+    # override the default configuration
+    if [ -f "${IMACONFIG}" ]; then
+        . ${IMACONFIG}
+    fi
+
+    if [ -z "${IMAKEYDIR}" ]; then
+        IMAKEYSDIR="/etc/keys/ima"
+    fi
+
+    PUBKEY_LIST=`ls ${NEWROOT}${IMAKEYSDIR}/*`
+    for PUBKEY in ${PUBKEY_LIST}; do
+        # check for public key's existence
+        if [ ! -f "${PUBKEY}" ]; then
+            if [ "${RD_DEBUG}" = "yes" ]; then
+                info "integrity: IMA x509 cert file not found: ${PUBKEY}"
+            fi
+            continue
+        fi
+
+        X509ID=$(evmctl import ${PUBKEY} ${KEYRING_ID})
+        if [ $? -ne 0 ]; then
+            info "integrity: IMA x509 cert not loaded on keyring: ${PUBKEY}"
+        fi 
+    done
+
+    if [ "${RD_DEBUG}" = "yes" ]; then
+        keyctl show  ${KEYRING_ID}
+    fi
+    return 0
+}
+
+# check kernel support for IMA
+if [ ! -e "${IMASECDIR}" ]; then
+    if [ "${RD_DEBUG}" = "yes" ]; then
+        info "integrity: IMA kernel support is disabled"
+    fi
+    return 0
+fi
+
+# get the IMA keyring id
+line=$(keyctl describe %keyring:.ima)
+if [ $? -eq 0 ]; then
+    _ima_id=${line%%:*}
+else
+    _ima_id=`keyctl search @u keyring _ima`
+    if [ -z "${_ima_id}" ]; then
+        _ima_id=`keyctl newring _ima @u`
+    fi
+fi
+
+# load the IMA public key(s)
+load_x509_keys ${_ima_id}
diff --git a/modules.d/98integrity/module-setup.sh b/modules.d/98integrity/module-setup.sh
index 2d4d2ed..34b33cd 100755
--- a/modules.d/98integrity/module-setup.sh
+++ b/modules.d/98integrity/module-setup.sh
@@ -13,6 +13,8 @@ depends() {
 
 # called by dracut
 install() {
+    dracut_install evmctl keyctl ls
     inst_hook pre-pivot 61 "$moddir/evm-enable.sh"
+    inst_hook pre-pivot 61 "$moddir/ima-keys-load.sh"
     inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
 }