From e26895fa86d6cf22b0a51ed1fcfc4bb6208a260d Mon Sep 17 00:00:00 2001 From: Bruno Meneguele Date: Mon, 6 Jul 2026 15:12:41 -0300 Subject: [PATCH] ima-setup: expand copy metadata perservation Instead of a raw copy of extended attributes, it would be intestering to keep all the SELinux labels using the official supported method and also the file timestamp to differentiate between a policy update (preserving the policy timestamp) and a raw change in the file. Signed-off-by: Bruno Meneguele --- ima-setup.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ima-setup.sh b/ima-setup.sh index bc689f8..178f1fd 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -113,7 +113,7 @@ load_ima_policy() { # policy containing rules like "appraise obj_type=ifconfig_exec_t" can be # loaded [[ -e /etc/ima ]] || mkdir -p /etc/ima/ - if ! cp --preserve=xattr "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then + if ! cp --preserve=all "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then echo "Failed to copy $ima_policy_path to $IMA_SYSTEMD_POLICY" return 1 fi @@ -125,7 +125,7 @@ load_ima_keys # Include the dracut integrity module to load the IMA keys and policy # automatically when there is a system reboot if ! lsinitrd --mod | grep -q integrity; then - cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf + cp --preserve=all /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module" dracut -f