import CS ima-evm-utils-1.6.2-4.el9
This commit is contained in:
AlmaLinux RelEng Bot
parent
995ed3110b
commit
c0025b027c
@ -12,16 +12,14 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_t
|
||||
specicifed package.
|
||||
|
||||
--reinstall_threshold
|
||||
When there are >reinstall_threshold (=20 by default) packages in the RPM
|
||||
DB missing IMA signatures, reinstalling the packages to add IMA
|
||||
signatures to the packages. By default, IMA sigatures will be obtained
|
||||
from the RPM DB. However the RPM DB may not have the signatures. Dectect
|
||||
this case by checking if there are >reinstall_threshold package missing
|
||||
IMA signatures.
|
||||
By default, IMA sigatures will be obtained from the RPM DB, however the
|
||||
RPM DB may not have them. Dectect this case by checking if there are
|
||||
>reinstall_threshold (=20 by default) package missing IMA signatures
|
||||
and reinstall them.
|
||||
|
||||
--ima_cert
|
||||
With the signing IMA cert path specified, it will also try to verify the
|
||||
added IMA signature.
|
||||
With the signing IMA cert path specified, it will try to verify the added
|
||||
IMA signature with the provided cert. Otherwise, system's cert is used.
|
||||
|
||||
EOF
|
||||
exit 1
|
||||
|
||||
@ -13,16 +13,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM]
|
||||
--policy
|
||||
The path of IMA policy to be loaded. Sample polices are inside
|
||||
/usr/share/ima/policies or you can use your own IMA policy
|
||||
The path of IMA policy to be loaded. Sample polices are inside
|
||||
/usr/share/ima/policies or you can use your own IMA policy
|
||||
|
||||
--reinstall_threshold
|
||||
When there are >reinstall_threshold packages in the RPM DB missing IMA
|
||||
signatures, reinstalling the packages to add IMA signatures to the
|
||||
packages. By default, IMA sigatures will be obtained from the RPM DB.
|
||||
However the RPM DB may not have the signatures. Dectect this case by
|
||||
checking if there are >reinstall_threshold package missing IMA
|
||||
signatures.
|
||||
By default, IMA sigatures will be obtained from the RPM DB. However the
|
||||
RPM DB may not have the signatures. Dectect this case by checking if
|
||||
there are >reinstall_threshold package missing IMA signatures and
|
||||
reinstall them.
|
||||
|
||||
EOF
|
||||
exit 1
|
||||
@ -32,7 +28,7 @@ for _opt in "$@"; do
|
||||
case "$_opt" in
|
||||
--policy=*)
|
||||
ima_policy_path=${_opt#*=}
|
||||
if [[ ! -e $ima_policy_path ]]; then
|
||||
if [[ ! -r $ima_policy_path ]]; then
|
||||
echo "$ima_policy_path doesn't exist"
|
||||
exit 1
|
||||
fi
|
||||
@ -50,6 +46,14 @@ if [[ $# -eq 0 ]]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
# Check for required argument
|
||||
if [[ "$ima_policy_path" == "" ]]; then
|
||||
echo "No policy file was given"
|
||||
echo
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Installing prerequisite package rpm-plugin-ima"
|
||||
if ! dnf install rpm-plugin-ima -yq; then
|
||||
echo "Failed to install rpm-plugin-ima, abort"
|
||||
@ -101,10 +105,6 @@ load_ima_policy() {
|
||||
|
||||
ima_policy_path=$1
|
||||
|
||||
if ! test -f "$ima_policy_path"; then
|
||||
echo "$ima_policy_path doesn't exist"
|
||||
return 1
|
||||
fi
|
||||
if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then
|
||||
echo "$ima_policy_path can't be loaded"
|
||||
return 1
|
||||
@ -113,7 +113,7 @@ load_ima_policy() {
|
||||
# policy containing rules like "appraise obj_type=ifconfig_exec_t" can be
|
||||
# loaded
|
||||
[[ -e /etc/ima ]] || mkdir -p /etc/ima/
|
||||
if ! cp --preserve=xattr "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then
|
||||
if ! cp --preserve=all "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then
|
||||
echo "Failed to copy $ima_policy_path to $IMA_SYSTEMD_POLICY"
|
||||
return 1
|
||||
fi
|
||||
@ -125,7 +125,7 @@ load_ima_keys
|
||||
# Include the dracut integrity module to load the IMA keys and policy
|
||||
# automatically when there is a system reboot
|
||||
if ! lsinitrd --mod | grep -q integrity; then
|
||||
cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf
|
||||
cp --preserve=all /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf
|
||||
echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module"
|
||||
dracut -f
|
||||
|
||||
|
||||
@ -1,28 +1,5 @@
|
||||
# Skip some unsupported filesystems
|
||||
# This list of the filesystems can be found on
|
||||
# https://www.kernel.org/doc/Documentation/ABI/testing/ima_policy
|
||||
# PROC_SUPER_MAGIC
|
||||
dont_appraise fsmagic=0x9fa0
|
||||
# SYSFS_MAGIC
|
||||
dont_appraise fsmagic=0x62656572
|
||||
# DEBUGFS_MAGIC
|
||||
dont_appraise fsmagic=0x64626720
|
||||
# TMPFS_MAGIC
|
||||
dont_appraise fsmagic=0x01021994
|
||||
# RAMFS_MAGIC
|
||||
dont_appraise fsmagic=0x858458f6
|
||||
# DEVPTS_SUPER_MAGIC
|
||||
dont_appraise fsmagic=0x1cd1
|
||||
# BINFMTFS_MAGIC
|
||||
dont_appraise fsmagic=0x42494e4d
|
||||
# SECURITYFS_MAGIC
|
||||
dont_appraise fsmagic=0x73636673
|
||||
# SELINUX_MAGIC
|
||||
dont_appraise fsmagic=0xf97cff8c
|
||||
# CGROUP_SUPER_MAGIC
|
||||
dont_appraise fsmagic=0x27e0eb
|
||||
# NSFS_MAGIC
|
||||
dont_appraise fsmagic=0x6e736673
|
||||
# Allow use cases like libffi
|
||||
dont_appraise mask=MAY_EXEC func=MMAP_CHECK fsmagic=0x01021994
|
||||
|
||||
appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig
|
||||
appraise func=BPRM_CHECK appraise_type=imasig
|
||||
|
||||
@ -8,7 +8,7 @@
|
||||
|
||||
Name: ima-evm-utils
|
||||
Version: 1.6.2
|
||||
Release: 2%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Summary: IMA/EVM support utilities
|
||||
License: GPLv2
|
||||
Url: http://linux-ima.sourceforge.net/
|
||||
@ -70,13 +70,13 @@ popd
|
||||
|
||||
%build
|
||||
autoreconf -vif
|
||||
%configure --disable-static
|
||||
%configure --disable-static --disable-debug
|
||||
%make_build
|
||||
|
||||
%if 0%{bootstrap}
|
||||
pushd compat/
|
||||
autoreconf -vif
|
||||
%configure --disable-static --disable-engine
|
||||
%configure --disable-static --disable-engine --disable-debug
|
||||
%make_build
|
||||
popd
|
||||
%endif
|
||||
@ -138,6 +138,12 @@ install -m 644 %{SOURCE300} %{SOURCE301} $RPM_BUILD_ROOT/etc/keys/ima/
|
||||
%{_libdir}/libimaevm.so
|
||||
|
||||
%changelog
|
||||
* Mon Jul 06 2026 Bruno Meneguele <bmeneg@redhat.com> - 1.6.2-4
|
||||
- ima-setup: improve script input handling (RHEL-192456)
|
||||
|
||||
* Tue Mar 10 2026 Coiby Xu <coxu@redhat.com> - 1.6.2-3
|
||||
- Don't allow files in tmpfs to be executed (RHEL-153545)
|
||||
|
||||
* Thu Jul 31 2025 Coiby Xu <coxu@redhat.com> - 1.6.2-2
|
||||
- Verify IMA signature to make sure it's correct (RHEL-105471)
|
||||
- Drop old libimaevm.so.4 (RHEL-82797)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user