478b5e4548
Resolves: https://issues.redhat.com/browse/RHEL-34778 Conflict: Upstream has -libs subpackage Upstream Status: https://src.fedoraproject.org/rpms/ima-evm-utils.git commit 8980421a049c776e2b77e534793aafb925b3ad48 Author: Coiby Xu <coiby.xu@gmail.com> Date: Mon May 6 17:48:52 2024 +0800 Add some IMA setup tools Some IMA setup tools are added to ease IMA setup which will do the following tasks, - add IMA signatures to installed packages files - load IMA keys and policy - enable the dracut integrity module to load IMA keys and policy automatically Two IMA polices as suggested by Stefan Berger are also provided which will be signed automatically with other package files. Thanks to Marko Myllynen for coming up with the idea to have a tool similar to fips-mode-setup. And thanks to Mimi Zohar and Stefan Berger for providing the feedback! Signed-off-by: Coiby Xu <coxu@redhat.com> Signed-off-by: Coiby Xu <coxu@redhat.com>
38 lines
960 B
Plaintext
38 lines
960 B
Plaintext
# PROC_SUPER_MAGIC
|
|
dont_measure fsmagic=0x9fa0
|
|
# SYSFS_MAGIC
|
|
dont_measure fsmagic=0x62656572
|
|
# DEBUGFS_MAGIC
|
|
dont_measure fsmagic=0x64626720
|
|
# TMPFS_MAGIC
|
|
dont_measure fsmagic=0x01021994
|
|
# DEVPTS_SUPER_MAGIC
|
|
dont_measure fsmagic=0x1cd1
|
|
# BINFMTFS_MAGIC
|
|
dont_measure fsmagic=0x42494e4d
|
|
# SECURITYFS_MAGIC
|
|
dont_measure fsmagic=0x73636673
|
|
# SELINUX_MAGIC
|
|
dont_measure fsmagic=0xf97cff8c
|
|
# SMACK_MAGIC
|
|
dont_measure fsmagic=0x43415d53
|
|
# CGROUP_SUPER_MAGIC
|
|
dont_measure fsmagic=0x27e0eb
|
|
# CGROUP2_SUPER_MAGIC
|
|
dont_measure fsmagic=0x63677270
|
|
# NSFS_MAGIC
|
|
dont_measure fsmagic=0x6e736673
|
|
# EFIVARFS_MAGIC
|
|
dont_measure fsmagic=0xde5e81e4
|
|
# OVERLAYFS_MAGIC
|
|
# when containers are used we almost always want to ignore them
|
|
dont_measure fsmagic=0x794c7630
|
|
|
|
|
|
# Measure and log keys loaded onto the .ima keyring
|
|
measure func=KEY_CHECK keyrings=.ima
|
|
# Measure and log executables
|
|
measure func=BPRM_CHECK
|
|
# Measure and log shared libraries
|
|
measure func=FILE_MMAP mask=MAY_EXEC
|