rpms/ima-evm-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

ima-setup: check for required argument

Browse Source 
The IMA policy file is required for the setup but it was not being checked
if the user passed it before checking if the policy file existed, thus an
empty argument would fail with a weird "  doesn't exist" message.

This commit adds the check for the argument presence at the beginning of the
script, guaranteeing it cannot be empty, and remove the policy file
existence from the middle of runtime, leaving the check already in place at
the argument parsing logic.

At the same time, reword parts of the usage message to make things clearer.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
This commit is contained in:
Bruno Meneguele 2026-07-06 15:11:17 -03:00
parent 9a971864a1
commit 178d35c55d
No known key found for this signature in database
GPG Key ID: 61D464151F91A243
2 changed files with 19 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ima-add-sigs.sh
View File

@ -12,16 +12,14 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_t
specicifed package.
--reinstall_threshold
When there are >reinstall_threshold (=20 by default) packages in the RPM
DB missing IMA signatures, reinstalling the packages to add IMA
signatures to the packages. By default, IMA sigatures will be obtained
from the RPM DB. However the RPM DB may not have the signatures. Dectect
this case by checking if there are >reinstall_threshold package missing
IMA signatures.
By default, IMA sigatures will be obtained from the RPM DB, however the
RPM DB may not have them. Dectect this case by checking if there are
>reinstall_threshold (=20 by default) package missing IMA signatures
and reinstall them.
--ima_cert
With the signing IMA cert path specified, it will also try to verify the
added IMA signature.
With the signing IMA cert path specified, it will try to verify the added
IMA signature with the provided cert. Otherwise, system's cert is used.
EOF
exit 1

26
ima-setup.sh
View File

@ -13,16 +13,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM]
--policy
The path of IMA policy to be loaded. Sample polices are inside
/usr/share/ima/policies or you can use your own IMA policy
The path of IMA policy to be loaded. Sample polices are inside
/usr/share/ima/policies or you can use your own IMA policy
--reinstall_threshold
When there are >reinstall_threshold packages in the RPM DB missing IMA
signatures, reinstalling the packages to add IMA signatures to the
packages. By default, IMA sigatures will be obtained from the RPM DB.
However the RPM DB may not have the signatures. Dectect this case by
checking if there are >reinstall_threshold package missing IMA
signatures.
By default, IMA sigatures will be obtained from the RPM DB. However the
RPM DB may not have the signatures. Dectect this case by checking if
there are >reinstall_threshold package missing IMA signatures and
reinstall them.
EOF
exit 1
@ -32,7 +28,7 @@ for _opt in "$@"; do
case "$_opt" in
--policy=*)
ima_policy_path=${_opt#*=}
if [[ ! -e $ima_policy_path ]]; then
if [[ ! -r $ima_policy_path ]]; then
echo "$ima_policy_path doesn't exist"
exit 1
fi
@ -50,6 +46,14 @@ if [[ $# -eq 0 ]]; then
usage
fi
# Check for required argument
if [[ "$ima_policy_path" == "" ]]; then
echo "No policy file was given"
echo
usage
exit 1
fi
echo "Installing prerequisite package rpm-plugin-ima"
if ! dnf install rpm-plugin-ima -yq; then
echo "Failed to install rpm-plugin-ima, abort"
@ -101,10 +105,6 @@ load_ima_policy() {
ima_policy_path=$1
if ! test -f "$ima_policy_path"; then
echo "$ima_policy_path doesn't exist"
return 1
fi
if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then
echo "$ima_policy_path can't be loaded"
return 1