From 5ff49ee7317416cf83c21234767090625e5b9036 Mon Sep 17 00:00:00 2001 From: Bruno Meneguele Date: Mon, 6 Jul 2026 08:09:35 -0300 Subject: [PATCH] ima-setup: check for required argument The IMA policy file is required for the setup but it was not being checked if the user passed it before checking if the policy file existed, thus an empty argument would fail with a weird " doesn't exist" message. This commit adds the check for the argument presence at the beginning of the script, guaranteeing it cannot be empty, and remove the policy file existence from the middle of runtime, leaving the check already in place at the argument parsing logic. At the same time, reword parts of the usage message to make things clearer. Signed-off-by: Bruno Meneguele --- ima-add-sigs.sh | 14 ++++++-------- ima-setup.sh | 26 +++++++++++++------------- 2 files changed, 19 insertions(+), 21 deletions(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index f0e9dd0..1809b39 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -12,16 +12,14 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_t specicifed package. --reinstall_threshold - When there are >reinstall_threshold (=20 by default) packages in the RPM - DB missing IMA signatures, reinstalling the packages to add IMA - signatures to the packages. By default, IMA sigatures will be obtained - from the RPM DB. However the RPM DB may not have the signatures. Dectect - this case by checking if there are >reinstall_threshold package missing - IMA signatures. + By default, IMA sigatures will be obtained from the RPM DB, however the + RPM DB may not have them. Dectect this case by checking if there are + >reinstall_threshold (=20 by default) package missing IMA signatures + and reinstall them. --ima_cert - With the signing IMA cert path specified, it will also try to verify the - added IMA signature. + With the signing IMA cert path specified, it will try to verify the added + IMA signature with the provided cert. Otherwise, system's cert is used. EOF exit 1 diff --git a/ima-setup.sh b/ima-setup.sh index 8223374..fb07f04 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -13,16 +13,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM] --policy The path of IMA policy to be loaded. Sample polices are inside /usr/share/ima/policies or you can use your own IMA policy - The path of IMA policy to be loaded. Sample polices are inside - /usr/share/ima/policies or you can use your own IMA policy --reinstall_threshold - When there are >reinstall_threshold packages in the RPM DB missing IMA - signatures, reinstalling the packages to add IMA signatures to the - packages. By default, IMA sigatures will be obtained from the RPM DB. - However the RPM DB may not have the signatures. Dectect this case by - checking if there are >reinstall_threshold package missing IMA - signatures. + By default, IMA sigatures will be obtained from the RPM DB. However the + RPM DB may not have the signatures. Dectect this case by checking if + there are >reinstall_threshold package missing IMA signatures and + reinstall them. EOF exit 1 @@ -32,7 +28,7 @@ for _opt in "$@"; do case "$_opt" in --policy=*) ima_policy_path=${_opt#*=} - if [[ ! -e $ima_policy_path ]]; then + if [[ ! -r $ima_policy_path ]]; then echo "$ima_policy_path doesn't exist" exit 1 fi @@ -50,6 +46,14 @@ if [[ $# -eq 0 ]]; then usage fi +# Check for required argument +if [[ "$ima_policy_path" == "" ]]; then + echo "No policy file was given" + echo + usage + exit 1 +fi + if ! rpm --quiet -q rpm-plugin-ima; then echo "Installing prerequisite package rpm-plugin-ima" if ! dnf install rpm-plugin-ima -yq; then @@ -103,10 +107,6 @@ load_ima_policy() { ima_policy_path=$1 - if ! test -f "$ima_policy_path"; then - echo "$ima_policy_path doesn't exist" - return 1 - fi if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then echo "$ima_policy_path can't be loaded" return 1