133 lines
5.4 KiB
Diff
133 lines
5.4 KiB
Diff
From 1073747b7bf00868be61d0d25e038fa48d62a6c7 Mon Sep 17 00:00:00 2001
|
|
From: Sergio Correia <scorreia@redhat.com>
|
|
Date: Thu, 9 Jul 2026 20:08:06 -0400
|
|
Subject: [PATCH 3/3] Disable push model (agent-driven attestation) for RHEL 9
|
|
|
|
Push mode is not yet supported in this build. Gate it off by removing
|
|
the push model agent from the workspace build, removing push-model-only
|
|
configuration options from the shipped agent.conf, and removing the
|
|
Conflicts= reference to the push model systemd service.
|
|
|
|
The push model crate and shared library support code remain in the tree
|
|
as dead code for easy re-enablement later.
|
|
|
|
Signed-off-by: Sergio Correia <scorreia@redhat.com>
|
|
---
|
|
Cargo.toml | 1 -
|
|
dist/systemd/system/keylime_agent.service | 1 -
|
|
keylime-agent.conf | 70 -----------------------
|
|
3 files changed, 72 deletions(-)
|
|
|
|
diff --git a/Cargo.toml b/Cargo.toml
|
|
index 95ca202..e31ca07 100644
|
|
--- a/Cargo.toml
|
|
+++ b/Cargo.toml
|
|
@@ -3,7 +3,6 @@ members = [
|
|
"keylime",
|
|
"keylime-agent", "keylime-macros",
|
|
"keylime-ima-emulator",
|
|
- "keylime-push-model-agent",
|
|
]
|
|
resolver = "2"
|
|
|
|
diff --git a/dist/systemd/system/keylime_agent.service b/dist/systemd/system/keylime_agent.service
|
|
index 562f975..479cbfb 100644
|
|
--- a/dist/systemd/system/keylime_agent.service
|
|
+++ b/dist/systemd/system/keylime_agent.service
|
|
@@ -11,7 +11,6 @@ After=tpm2-abrmd.service
|
|
# If the service should start only when hardware TPMs are available, uncomment the below lines
|
|
#ConditionPathExistsGlob=/dev/tpm[0-9]*
|
|
#ConditionPathExistsGlob=/dev/tpmrm[0-9]*
|
|
-Conflicts=keylime_push_model_agent.service
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/keylime_agent
|
|
diff --git a/keylime-agent.conf b/keylime-agent.conf
|
|
index a9d8220..29d0d6d 100644
|
|
--- a/keylime-agent.conf
|
|
+++ b/keylime-agent.conf
|
|
@@ -396,57 +396,6 @@ ima_ml_path = "default"
|
|
# If set as an absolute path, it will use it without changes
|
|
measuredboot_ml_path = "default"
|
|
|
|
-# Push attestation model options
|
|
-# The interval in seconds between attestations after a successful attestation,
|
|
-# and also used as the retry delay after a failed attestation attempt.
|
|
-# This option is specific to the push attestation model.
|
|
-# The default is 60 seconds.
|
|
-#
|
|
-# To override attestation_interval_seconds, set
|
|
-# KEYLIME_AGENT_ATTESTATION_INTERVAL_SECONDS environment variable.
|
|
-attestation_interval_seconds = 60
|
|
-
|
|
-# Verifier URL (Push Model specific).
|
|
-# Verifier URL containing schema, host and port
|
|
-verifier_url = "https://localhost:8881"
|
|
-
|
|
-# Verifier TLS CA certificate (Push Model specific)
|
|
-# The push model agent uses TLS (server verification only) + mandatory PoP authentication.
|
|
-# Client certificates (mTLS) are NOT used by the push model.
|
|
-# This CA certificate is used to verify the verifier's server certificate.
|
|
-# If set as "default", the path below is used relative to keylime_dir.
|
|
-# If a relative path is set, it will be considered relative from the keylime_dir.
|
|
-# If an absolute path is set, it is used without change.
|
|
-#
|
|
-# To override verifier_tls_ca_cert, set KEYLIME_AGENT_VERIFIER_TLS_CA_CERT environment variable.
|
|
-verifier_tls_ca_cert = "default" # default: cv_ca/cacert.crt
|
|
-
|
|
-# The API versions to use when communicating with the registrar (Push Model
|
|
-# specific). The agent will negotiate with the registrar to select the best
|
|
-# mutually supported version.
|
|
-# A list of versions can be provided (e.g. "2.1, 2.3").
|
|
-# The following keywords are also supported:
|
|
-# - "default": Enables all supported API versions
|
|
-# - "latest": Enables only the latest supported API version
|
|
-#
|
|
-# To override registrar_api_versions, set
|
|
-# KEYLIME_AGENT_REGISTRAR_API_VERSIONS environment variable.
|
|
-registrar_api_versions = "default"
|
|
-
|
|
-# The server identifier used for certification keys (Push Model specific).
|
|
-# This identifier is used when building AK certification data.
|
|
-#
|
|
-# To override certification_keys_server_identifier, set
|
|
-# KEYLIME_AGENT_CERTIFICATION_KEYS_SERVER_IDENTIFIER environment variable.
|
|
-certification_keys_server_identifier = "ak"
|
|
-
|
|
-# The evidence version to use for UEFI event logs sent during attestation
|
|
-# (Push Model specific).
|
|
-#
|
|
-# To override uefi_logs_evidence_version, set
|
|
-# KEYLIME_AGENT_UEFI_LOGS_EVIDENCE_VERSION environment variable.
|
|
-uefi_logs_evidence_version = "2.1"
|
|
-
|
|
# Exponential backoff settings for retrying failed operations such as
|
|
# registrar registration and verifier attestation.
|
|
# The initial_delay is the delay in milliseconds before the first retry.
|
|
@@ -462,22 +411,3 @@ uefi_logs_evidence_version = "2.1"
|
|
exponential_backoff_initial_delay = 10000
|
|
exponential_backoff_max_retries = 5
|
|
exponential_backoff_max_delay = 300000
|
|
-
|
|
-# TLS security options (INSECURE - for testing/debugging only)
|
|
-# These options disable TLS verification and should NEVER be enabled in
|
|
-# production environments.
|
|
-#
|
|
-# Accept invalid TLS certificates (e.g. self-signed, expired, wrong CA).
|
|
-# WARNING: Enabling this makes the agent vulnerable to man-in-the-middle attacks.
|
|
-#
|
|
-# To override tls_accept_invalid_certs, set
|
|
-# KEYLIME_AGENT_TLS_ACCEPT_INVALID_CERTS environment variable.
|
|
-tls_accept_invalid_certs = false
|
|
-
|
|
-# Accept TLS certificates where the hostname does not match the certificate's
|
|
-# subject or SAN fields.
|
|
-# WARNING: Enabling this makes the agent vulnerable to man-in-the-middle attacks.
|
|
-#
|
|
-# To override tls_accept_invalid_hostnames, set
|
|
-# KEYLIME_AGENT_TLS_ACCEPT_INVALID_HOSTNAMES environment variable.
|
|
-tls_accept_invalid_hostnames = false
|
|
--
|
|
2.52.0
|
|
|