diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 6be5c48..a9fa95d 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -12,16 +12,14 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_t specicifed package. --reinstall_threshold - When there are >reinstall_threshold (=20 by default) packages in the RPM - DB missing IMA signatures, reinstalling the packages to add IMA - signatures to the packages. By default, IMA sigatures will be obtained - from the RPM DB. However the RPM DB may not have the signatures. Dectect - this case by checking if there are >reinstall_threshold package missing - IMA signatures. + By default, IMA sigatures will be obtained from the RPM DB, however the + RPM DB may not have them. Dectect this case by checking if there are + >reinstall_threshold (=20 by default) package missing IMA signatures + and reinstall them. --ima_cert - With the signing IMA cert path specified, it will also try to verify the - added IMA signature. + With the signing IMA cert path specified, it will try to verify the added + IMA signature with the provided cert. Otherwise, system's cert is used. EOF exit 1 diff --git a/ima-setup.sh b/ima-setup.sh index 4a61a28..bc689f8 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -13,16 +13,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM] --policy The path of IMA policy to be loaded. Sample polices are inside /usr/share/ima/policies or you can use your own IMA policy - The path of IMA policy to be loaded. Sample polices are inside - /usr/share/ima/policies or you can use your own IMA policy --reinstall_threshold - When there are >reinstall_threshold packages in the RPM DB missing IMA - signatures, reinstalling the packages to add IMA signatures to the - packages. By default, IMA sigatures will be obtained from the RPM DB. - However the RPM DB may not have the signatures. Dectect this case by - checking if there are >reinstall_threshold package missing IMA - signatures. + By default, IMA sigatures will be obtained from the RPM DB. However the + RPM DB may not have the signatures. Dectect this case by checking if + there are >reinstall_threshold package missing IMA signatures and + reinstall them. EOF exit 1 @@ -32,7 +28,7 @@ for _opt in "$@"; do case "$_opt" in --policy=*) ima_policy_path=${_opt#*=} - if [[ ! -e $ima_policy_path ]]; then + if [[ ! -r $ima_policy_path ]]; then echo "$ima_policy_path doesn't exist" exit 1 fi @@ -50,6 +46,14 @@ if [[ $# -eq 0 ]]; then usage fi +# Check for required argument +if [[ "$ima_policy_path" == "" ]]; then + echo "No policy file was given" + echo + usage + exit 1 +fi + echo "Installing prerequisite package rpm-plugin-ima" if ! dnf install rpm-plugin-ima -yq; then echo "Failed to install rpm-plugin-ima, abort" @@ -101,10 +105,6 @@ load_ima_policy() { ima_policy_path=$1 - if ! test -f "$ima_policy_path"; then - echo "$ima_policy_path doesn't exist" - return 1 - fi if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then echo "$ima_policy_path can't be loaded" return 1