Instead of a raw copy of extended attributes, it would be intestering to
keep all the SELinux labels using the official supported method and also the
file timestamp to differentiate between a policy update (preserving the
policy timestamp) and a raw change in the file.
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
The IMA policy file is required for the setup but it was not being checked
if the user passed it before checking if the policy file existed, thus an
empty argument would fail with a weird " doesn't exist" message.
This commit adds the check for the argument presence at the beginning of the
script, guaranteeing it cannot be empty, and remove the policy file
existence from the middle of runtime, leaving the check already in place at
the argument parsing logic.
At the same time, reword parts of the usage message to make things clearer.
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
Relates: https://issues.redhat.com/browse/RHEL-74293
Conflict: None
Upstream Status: https://src.fedoraproject.org/rpms/ima-evm-utils.git
commit 7b800d82d0947fd0e75e92997a3aec7af079c1cc
Author: Coiby Xu <coxu@redhat.com>
Date: Tue Feb 25 13:24:33 2025 +0800
ima-setup: fix two shellcheck warnings
Fix the following two shellcheck warnings,
In ima-setup.sh line 36:
echo "$policy_file doesn't exist"
^----------^ SC2154 (warning): policy_file is referenced but not assigned.
In ima-setup.sh line 41:
reinstall_threshold=${_opt#*=}
^-----------------^ SC2034 (warning): reinstall_threshold appears unused. Verify use (or export if used externally).
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Resolves: https://issues.redhat.com/browse/RHEL-33751
Conflict: Fix a typo.
Upstream Status: https://src.fedoraproject.org/rpms/ima-evm-utils.git
commit 62f613cbb7e1753b2e8fa0ce547c02be24842b22
Author: Coiby Xu <coxu@redhat.com>
Date: Mon Jun 3 14:39:06 2024 +0800
ima-setup: include the integrity module for the default kernel
ima-setup may run after a new kernel is installed. Detect this case by
checking if the default kernel is the running kernel.
Suggested-by: Marko Myllynen <myllynen@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Resolves: https://issues.redhat.com/browse/RHEL-33751
Conflict: None
Upstream Status: https://src.fedoraproject.org/rpms/ima-evm-utils.git
commit 141a74d96ab3cdee1b0d2cf6a0cba19337920e02
Author: Coiby Xu <coxu@redhat.com>
Date: Tue May 28 09:54:19 2024 +0800
ima-setup: Allow users to specify custom reinstall_threshold
Some users may use custom built packages and we are not sure about the
number of this type of packages. So make reinstall_threshold
configurable.
Suggested-by: Marko Myllynen <myllynen@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Resolves: https://issues.redhat.com/browse/RHEL-33751
Conflict: Upstream has -libs subpackage
Upstream Status: https://src.fedoraproject.org/rpms/ima-evm-utils.git
commit 8980421a049c776e2b77e534793aafb925b3ad48
Author: Coiby Xu <coiby.xu@gmail.com>
Date: Mon May 6 17:48:52 2024 +0800
Add some IMA setup tools
Some IMA setup tools are added to ease IMA setup which will do
the following tasks,
- add IMA signatures to installed packages files
- load IMA keys and policy
- enable the dracut integrity module to load IMA keys and policy
automatically
Two IMA polices as suggested by Stefan Berger are also provided which
will be signed automatically with other package files.
Thanks to Marko Myllynen for coming up with the idea to have a tool
similar to fips-mode-setup. And thanks to Mimi Zohar and Stefan Berger
for providing the feedback!
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
