rpms/ima-evm-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

ima-setup: expand copy metadata perservation

Browse Source 
Instead of a raw copy of extended attributes, it would be intestering to
keep all the SELinux labels using the official supported method and also the
file timestamp to differentiate between a policy update (preserving the
policy timestamp) and a raw change in the file.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
This commit is contained in:
Bruno Meneguele 2026-07-06 15:12:41 -03:00
parent 178d35c55d
commit e26895fa86
No known key found for this signature in database
GPG Key ID: 61D464151F91A243
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ima-setup.sh
View File

@ -113,7 +113,7 @@ load_ima_policy() {
# policy containing rules like "appraise obj_type=ifconfig_exec_t" can be
# loaded
[[ -e /etc/ima ]] || mkdir -p /etc/ima/
if ! cp --preserve=xattr "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then
if ! cp --preserve=all "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then
echo "Failed to copy $ima_policy_path to $IMA_SYSTEMD_POLICY"
return 1
fi
@ -125,7 +125,7 @@ load_ima_keys
# Include the dracut integrity module to load the IMA keys and policy
# automatically when there is a system reboot
if ! lsinitrd --mod | grep -q integrity; then
cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf
cp --preserve=all /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf
echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module"
dracut -f