From c0025b027c1cff978ad28deb0d04ca9626c641b3 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 24 Aug 2026 09:10:08 -0400 Subject: [PATCH] import CS ima-evm-utils-1.6.2-4.el9 --- SOURCES/ima-add-sigs.sh | 14 ++++----- SOURCES/ima-setup.sh | 30 +++++++++---------- ...-01-appraise-executable-and-lib-signatures | 27 ++--------------- SPECS/ima-evm-utils.spec | 12 ++++++-- 4 files changed, 32 insertions(+), 51 deletions(-) diff --git a/SOURCES/ima-add-sigs.sh b/SOURCES/ima-add-sigs.sh index 6be5c48..a9fa95d 100755 --- a/SOURCES/ima-add-sigs.sh +++ b/SOURCES/ima-add-sigs.sh @@ -12,16 +12,14 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_t specicifed package. --reinstall_threshold - When there are >reinstall_threshold (=20 by default) packages in the RPM - DB missing IMA signatures, reinstalling the packages to add IMA - signatures to the packages. By default, IMA sigatures will be obtained - from the RPM DB. However the RPM DB may not have the signatures. Dectect - this case by checking if there are >reinstall_threshold package missing - IMA signatures. + By default, IMA sigatures will be obtained from the RPM DB, however the + RPM DB may not have them. Dectect this case by checking if there are + >reinstall_threshold (=20 by default) package missing IMA signatures + and reinstall them. --ima_cert - With the signing IMA cert path specified, it will also try to verify the - added IMA signature. + With the signing IMA cert path specified, it will try to verify the added + IMA signature with the provided cert. Otherwise, system's cert is used. EOF exit 1 diff --git a/SOURCES/ima-setup.sh b/SOURCES/ima-setup.sh index 4a61a28..178f1fd 100755 --- a/SOURCES/ima-setup.sh +++ b/SOURCES/ima-setup.sh @@ -13,16 +13,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM] --policy The path of IMA policy to be loaded. Sample polices are inside /usr/share/ima/policies or you can use your own IMA policy - The path of IMA policy to be loaded. Sample polices are inside - /usr/share/ima/policies or you can use your own IMA policy --reinstall_threshold - When there are >reinstall_threshold packages in the RPM DB missing IMA - signatures, reinstalling the packages to add IMA signatures to the - packages. By default, IMA sigatures will be obtained from the RPM DB. - However the RPM DB may not have the signatures. Dectect this case by - checking if there are >reinstall_threshold package missing IMA - signatures. + By default, IMA sigatures will be obtained from the RPM DB. However the + RPM DB may not have the signatures. Dectect this case by checking if + there are >reinstall_threshold package missing IMA signatures and + reinstall them. EOF exit 1 @@ -32,7 +28,7 @@ for _opt in "$@"; do case "$_opt" in --policy=*) ima_policy_path=${_opt#*=} - if [[ ! -e $ima_policy_path ]]; then + if [[ ! -r $ima_policy_path ]]; then echo "$ima_policy_path doesn't exist" exit 1 fi @@ -50,6 +46,14 @@ if [[ $# -eq 0 ]]; then usage fi +# Check for required argument +if [[ "$ima_policy_path" == "" ]]; then + echo "No policy file was given" + echo + usage + exit 1 +fi + echo "Installing prerequisite package rpm-plugin-ima" if ! dnf install rpm-plugin-ima -yq; then echo "Failed to install rpm-plugin-ima, abort" @@ -101,10 +105,6 @@ load_ima_policy() { ima_policy_path=$1 - if ! test -f "$ima_policy_path"; then - echo "$ima_policy_path doesn't exist" - return 1 - fi if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then echo "$ima_policy_path can't be loaded" return 1 @@ -113,7 +113,7 @@ load_ima_policy() { # policy containing rules like "appraise obj_type=ifconfig_exec_t" can be # loaded [[ -e /etc/ima ]] || mkdir -p /etc/ima/ - if ! cp --preserve=xattr "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then + if ! cp --preserve=all "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then echo "Failed to copy $ima_policy_path to $IMA_SYSTEMD_POLICY" return 1 fi @@ -125,7 +125,7 @@ load_ima_keys # Include the dracut integrity module to load the IMA keys and policy # automatically when there is a system reboot if ! lsinitrd --mod | grep -q integrity; then - cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf + cp --preserve=all /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module" dracut -f diff --git a/SOURCES/policy-01-appraise-executable-and-lib-signatures b/SOURCES/policy-01-appraise-executable-and-lib-signatures index 53feed5..1d5ab50 100644 --- a/SOURCES/policy-01-appraise-executable-and-lib-signatures +++ b/SOURCES/policy-01-appraise-executable-and-lib-signatures @@ -1,28 +1,5 @@ -# Skip some unsupported filesystems -# This list of the filesystems can be found on -# https://www.kernel.org/doc/Documentation/ABI/testing/ima_policy -# PROC_SUPER_MAGIC -dont_appraise fsmagic=0x9fa0 -# SYSFS_MAGIC -dont_appraise fsmagic=0x62656572 -# DEBUGFS_MAGIC -dont_appraise fsmagic=0x64626720 -# TMPFS_MAGIC -dont_appraise fsmagic=0x01021994 -# RAMFS_MAGIC -dont_appraise fsmagic=0x858458f6 -# DEVPTS_SUPER_MAGIC -dont_appraise fsmagic=0x1cd1 -# BINFMTFS_MAGIC -dont_appraise fsmagic=0x42494e4d -# SECURITYFS_MAGIC -dont_appraise fsmagic=0x73636673 -# SELINUX_MAGIC -dont_appraise fsmagic=0xf97cff8c -# CGROUP_SUPER_MAGIC -dont_appraise fsmagic=0x27e0eb -# NSFS_MAGIC -dont_appraise fsmagic=0x6e736673 +# Allow use cases like libffi +dont_appraise mask=MAY_EXEC func=MMAP_CHECK fsmagic=0x01021994 appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig appraise func=BPRM_CHECK appraise_type=imasig diff --git a/SPECS/ima-evm-utils.spec b/SPECS/ima-evm-utils.spec index 3704345..dd697bf 100644 --- a/SPECS/ima-evm-utils.spec +++ b/SPECS/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 2%{?dist} +Release: 4%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -70,13 +70,13 @@ popd %build autoreconf -vif -%configure --disable-static +%configure --disable-static --disable-debug %make_build %if 0%{bootstrap} pushd compat/ autoreconf -vif -%configure --disable-static --disable-engine +%configure --disable-static --disable-engine --disable-debug %make_build popd %endif @@ -138,6 +138,12 @@ install -m 644 %{SOURCE300} %{SOURCE301} $RPM_BUILD_ROOT/etc/keys/ima/ %{_libdir}/libimaevm.so %changelog +* Mon Jul 06 2026 Bruno Meneguele - 1.6.2-4 +- ima-setup: improve script input handling (RHEL-192456) + +* Tue Mar 10 2026 Coiby Xu - 1.6.2-3 +- Don't allow files in tmpfs to be executed (RHEL-153545) + * Thu Jul 31 2025 Coiby Xu - 1.6.2-2 - Verify IMA signature to make sure it's correct (RHEL-105471) - Drop old libimaevm.so.4 (RHEL-82797)