From c29eac902a5966f4924c1a4a4f1e4f82ff336951 Mon Sep 17 00:00:00 2001
From: eabdullin <ed.abdullin.1@gmail.com>
Date: Tue, 11 Nov 2025 21:59:37 +0000
Subject: [PATCH] import UBI ima-evm-utils-1.6.2-3.el10

---
 ima-add-sigs.sh    | 45 +++++++++++++++++++++++++++++++++++++--------
 ima-evm-utils.spec |  8 +++++++-
 ima-setup.sh       |  6 +++---
 3 files changed, 47 insertions(+), 12 deletions(-)

diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh
index 6777d4b..6be5c48 100755
--- a/ima-add-sigs.sh
+++ b/ima-add-sigs.sh
@@ -4,7 +4,7 @@
 usage() {
 	echo "Add IMA signatures to installed packages."
 	cat <<EOF
-usage: $0 [--package=PACKAGE_NAME|ALL] [--ima-cert=IMA_CERT_PATH] [--reinstall_threshold=NUM]
+usage: $0 [--package=PACKAGE_NAME|ALL] [--ima_cert=IMA_CERT_PATH] [--reinstall_threshold=NUM]
 
        --package
        By default, it will add IMA sigantures to all installed package files.
@@ -19,7 +19,7 @@ usage: $0 [--package=PACKAGE_NAME|ALL] [--ima-cert=IMA_CERT_PATH] [--reinstall_t
        this case by checking if there are >reinstall_threshold package missing
        IMA signatures.
 
-       --ima-cert
+       --ima_cert
        With the signing IMA cert path specified, it will also try to verify the
        added IMA signature.
 
@@ -53,12 +53,35 @@ abort() {
 	exit 1
 }
 
+get_system_ima_key() {
+	source /etc/os-release
+	local -A name_map=(['Fedora Linux']="fedora" ['Red Hat Enterprise Linux']="redhatimarelease" ['CentOS Stream']='centosimarelease')
+	local version_id
+	key_name=${name_map[$NAME]}
+	version_id=${VERSION_ID/.?/}
+
+	[[ $key_name == fedora ]] && name_suffix=-ima
+	key_path=/etc/keys/ima/${key_name}-${version_id}${name_suffix}.der
+	if [[ ! -e $key_path ]]; then
+		echo "Failed to get system IMA code verification key"
+		exit 1
+	fi
+
+	echo -n "$key_path"
+}
+
 # Add IMA signatures from RPM database
 add_from_rpm_db() {
 	if ! command -v setfattr &>/dev/null; then
 		abort "Please install attr"
 	fi
 
+	if [[ -e "$ima_cert" ]]; then
+		verify_ima_cert=$ima_cert
+	else
+		verify_ima_cert=$(get_system_ima_key)
+	fi
+
 	# use "|" as deliminator since it won't be used in a filename or signature
 	while IFS="|" read -r path sig; do
 		# [[ -z "$sig" ]] somehow doesn't work for some files that don't have IMA
@@ -72,16 +95,22 @@ add_from_rpm_db() {
 			continue
 		fi
 
+		# Skip some files that are created on the fly
+		if [[ $path == "/usr/share/mime/"* || $path == "/etc/pki/ca-trust/extracted/"* ]]; then
+			continue
+		fi
+
 		if ! setfattr -n security.ima "$path" -v "0x$sig"; then
 			echo "Failed to add IMA sig for $path"
 		fi
 
-		[[ -e "$ima_cert" ]] || continue
-		# TODO
-		# don't verify the modified files like /etc?
-		if ! evmctl ima_verify -k "$ima_cert" "$path" &>/dev/null; then
-			echo "Failed to verify $path"
+		if ! evmctl ima_verify -k "$verify_ima_cert" "$path" &>/dev/null; then
+			setfattr -x security.ima "$path"
+			# When ima_cert is set, shows the verfication result for users
+			[[ -e "$ima_cert" ]] && "Failed to verify $path"
+			continue
 		fi
+
 	done < <(rpm -q --queryformat "[%{FILENAMES}|%{FILESIGNATURES}\n]" "$package")
 }
 
@@ -103,7 +132,7 @@ if [[ -z $reinstall_threshold ]]; then
 	fi
 fi
 
-unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep "^(none)$" | wc -l)
+unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep -c "^(none)$")
 
 if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then
 	add_by_reinstall
diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec
index 94d5a38..6af845f 100644
--- a/ima-evm-utils.spec
+++ b/ima-evm-utils.spec
@@ -8,7 +8,7 @@
 
 Name:    ima-evm-utils
 Version: 1.6.2
-Release: 1%{?dist}
+Release: 3%{?dist}
 Summary: IMA/EVM support utilities
 License: GPLv2
 Url:     http://linux-ima.sourceforge.net/
@@ -138,6 +138,12 @@ install -m 644 %{SOURCE300} %{SOURCE301} $RPM_BUILD_ROOT/etc/keys/ima/
 %{_libdir}/libimaevm.so
 
 %changelog
+* Thu Jul 31 2025 Coiby Xu <coxu@redhat.com> - 1.6.2-3
+- Verify IMA signature to make sure it's correct
+
+* Mon Mar 10 2025 Coiby Xu <coxu@redhat.com> - 1.6.2-2
+- ima-setup: run zipl after building initramfs for s390x (RHEL-82392)
+
 * Wed Jan 15 2025 Coiby Xu <coxu@redhat.com> - 1.6.2-1
 - Disable compat lib (RHEL-65376)
 
diff --git a/ima-setup.sh b/ima-setup.sh
index 915b61d..4a61a28 100755
--- a/ima-setup.sh
+++ b/ima-setup.sh
@@ -33,7 +33,7 @@ for _opt in "$@"; do
 	--policy=*)
 		ima_policy_path=${_opt#*=}
 		if [[ ! -e $ima_policy_path ]]; then
-			echo "$policy_file doesn't exist"
+			echo "$ima_policy_path doesn't exist"
 			exit 1
 		fi
 		;;
@@ -61,7 +61,7 @@ if test -f /run/ostree-booted; then
 	echo "You are using OSTree, please enable IMA signatures as part of the OSTree creation process."
 else
 	echo "Adding IMA signatures to installed package files"
-	if ! ima-add-sigs; then
+	if ! ima-add-sigs --reinstall_threshold="$reinstall_threshold"; then
 		echo "Failed to add IMA signatures, abort"
 		exit 1
 	fi
@@ -136,7 +136,7 @@ if ! lsinitrd --mod | grep -q integrity; then
 			dracut -f --kver "$_default_kernel"
 		fi
 	fi
-
+	[[ $(uname -m) == s390x ]] && zipl &> /dev/null
 fi
 
 if ! load_ima_policy "$ima_policy_path"; then