import keylime-6.5.0-1.el9
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
commit
0997a71bd6
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
SOURCES/v6.5.0.tar.gz
|
||||||
1
.keylime.metadata
Normal file
1
.keylime.metadata
Normal file
@ -0,0 +1 @@
|
|||||||
|
c1ec8577a5ca7a0dc024fe765310850e4fca593e SOURCES/v6.5.0.tar.gz
|
||||||
24
SOURCES/keylime.fc
Normal file
24
SOURCES/keylime.fc
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
/usr/bin/keylime_agent -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
/usr/bin/keylime_ima_emulator -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
/usr/bin/keylime_userdata_encrypt -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/bin/keylime_ca -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/bin/keylime_migrations_apply -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/bin/keylime_registrar -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/bin/keylime_verifier -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/bin/keylime_tenant -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/local/bin/keylime_agent -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_ima_emulator -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_userdata_encrypt -- gen_context(system_u:object_r:keylime_agent_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/local/bin/keylime_ca -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_migrations_apply -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_registrar -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_verifier -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
/usr/local/bin/keylime_tenant -- gen_context(system_u:object_r:keylime_server_exec_t,s0)
|
||||||
|
|
||||||
|
/var/lib/keylime(/.*)? gen_context(system_u:object_r:keylime_var_lib_t,s0)
|
||||||
|
/var/lib/keylime-agent(/.*)? gen_context(system_u:object_r:keylime_var_lib_t,s0)
|
||||||
|
|
||||||
|
/var/log/keylime(/.*)? gen_context(system_u:object_r:keylime_log_t,s0)
|
||||||
37
SOURCES/keylime.if
Normal file
37
SOURCES/keylime.if
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
## <summary>policy for keylime</summary>
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Add to specified type to keylime_type attribute .
|
||||||
|
## </summary>
|
||||||
|
## <param name="type">
|
||||||
|
## <summary>
|
||||||
|
## Type to be used for keylime domains.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`keylime_use_keylime_domain',`
|
||||||
|
gen_require(`
|
||||||
|
attribute keylime_domain;
|
||||||
|
')
|
||||||
|
|
||||||
|
typeattribute $1 keylime_domain;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Mounton keylime lib directory.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`keylime_mounton_var_lib',`
|
||||||
|
gen_require(`
|
||||||
|
type keylime_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 keylime_var_lib_t:dir mounton;
|
||||||
|
')
|
||||||
2
SOURCES/keylime.sysusers
Normal file
2
SOURCES/keylime.sysusers
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
u keylime - "Keylime unprivileged user" /var/lib/keylime /usr/sbin/nologin
|
||||||
|
m keylime tss
|
||||||
140
SOURCES/keylime.te
Normal file
140
SOURCES/keylime.te
Normal file
@ -0,0 +1,140 @@
|
|||||||
|
policy_module(keylime, 1.0.0)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
attribute keylime_domain;
|
||||||
|
|
||||||
|
type keylime_agent_t;
|
||||||
|
keylime_use_keylime_domain(keylime_agent_t)
|
||||||
|
type keylime_agent_exec_t;
|
||||||
|
init_daemon_domain(keylime_agent_t, keylime_agent_exec_t)
|
||||||
|
|
||||||
|
type keylime_server_t;
|
||||||
|
keylime_use_keylime_domain(keylime_server_t)
|
||||||
|
type keylime_server_exec_t;
|
||||||
|
init_daemon_domain(keylime_server_t, keylime_server_exec_t)
|
||||||
|
|
||||||
|
type keylime_log_t;
|
||||||
|
logging_log_file(keylime_log_t)
|
||||||
|
|
||||||
|
type keylime_var_lib_t;
|
||||||
|
files_type(keylime_var_lib_t)
|
||||||
|
|
||||||
|
type keylime_tmp_t;
|
||||||
|
files_tmp_file(keylime_tmp_t)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# keylime domain policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow keylime_domain self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
manage_dirs_pattern(keylime_domain, keylime_tmp_t, keylime_tmp_t)
|
||||||
|
manage_files_pattern(keylime_domain, keylime_tmp_t, keylime_tmp_t)
|
||||||
|
files_tmp_filetrans(keylime_domain, keylime_tmp_t, { dir file })
|
||||||
|
|
||||||
|
manage_dirs_pattern(keylime_domain, keylime_var_lib_t, keylime_var_lib_t)
|
||||||
|
manage_files_pattern(keylime_domain, keylime_var_lib_t, keylime_var_lib_t)
|
||||||
|
files_var_lib_filetrans(keylime_domain, keylime_var_lib_t, { dir file lnk_file })
|
||||||
|
|
||||||
|
corecmd_exec_bin(keylime_domain)
|
||||||
|
|
||||||
|
corenet_tcp_bind_generic_node(keylime_domain)
|
||||||
|
corenet_tcp_bind_all_ports(keylime_domain)
|
||||||
|
corenet_tcp_connect_all_unreserved_ports(keylime_domain)
|
||||||
|
|
||||||
|
dev_read_sysfs(keylime_domain)
|
||||||
|
|
||||||
|
fs_tmpfs_filetrans(keylime_domain, keylime_var_lib_t, { dir file })
|
||||||
|
|
||||||
|
init_named_socket_activation(keylime_domain, keylime_var_lib_t, "keylime")
|
||||||
|
|
||||||
|
miscfiles_read_generic_certs(keylime_domain)
|
||||||
|
|
||||||
|
sysnet_read_config(keylime_domain)
|
||||||
|
|
||||||
|
userdom_exec_user_tmp_files(keylime_domain)
|
||||||
|
userdom_manage_user_tmp_dirs(keylime_domain)
|
||||||
|
userdom_manage_user_tmp_files(keylime_domain)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# keylime server policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow keylime_server_t self:netlink_route_socket { create_stream_socket_perms nlmsg_read };
|
||||||
|
allow keylime_server_t self:udp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
manage_dirs_pattern(keylime_server_t, keylime_log_t, keylime_log_t)
|
||||||
|
manage_files_pattern(keylime_server_t, keylime_log_t, keylime_log_t)
|
||||||
|
|
||||||
|
fs_rw_inherited_tmpfs_files(keylime_server_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
gpg_exec(keylime_server_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
kerberos_read_config(keylime_server_t)
|
||||||
|
kerberos_read_keytab(keylime_server_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
sssd_run_stream_connect(keylime_server_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# keylime agent policy
|
||||||
|
#
|
||||||
|
#work with /var/lib/keylime/secure
|
||||||
|
allow keylime_agent_t self:capability { chown dac_override dac_read_search setgid setuid sys_nice sys_ptrace };
|
||||||
|
allow keylime_agent_t self:chr_file getattr;
|
||||||
|
|
||||||
|
#FIX ME, add to tabrmd policy interface related with this
|
||||||
|
allow keylime_agent_t domain:unix_stream_socket rw_stream_socket_perms; #selint-disable:W-001
|
||||||
|
|
||||||
|
dev_rw_tpm(keylime_agent_t)
|
||||||
|
|
||||||
|
exec_files_pattern(keylime_agent_t, keylime_var_lib_t, keylime_var_lib_t)
|
||||||
|
files_read_var_lib_files(keylime_agent_t)
|
||||||
|
|
||||||
|
fs_dontaudit_search_cgroup_dirs(keylime_agent_t)
|
||||||
|
fs_getattr_cgroup(keylime_agent_t)
|
||||||
|
fs_mount_tmpfs(keylime_agent_t)
|
||||||
|
fs_setattr_tmpfs_dirs(keylime_agent_t)
|
||||||
|
|
||||||
|
init_dontaudit_stream_connect(keylime_agent_t)
|
||||||
|
|
||||||
|
kernel_read_all_proc(keylime_agent_t)
|
||||||
|
|
||||||
|
userdom_dontaudit_search_user_home_dirs(keylime_agent_t)
|
||||||
|
|
||||||
|
auth_read_passwd(keylime_agent_t)
|
||||||
|
|
||||||
|
keylime_mounton_var_lib(keylime_agent_t)
|
||||||
|
|
||||||
|
mount_domtrans(keylime_agent_t)
|
||||||
|
|
||||||
|
selinux_read_policy(keylime_agent_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
#FIX ME, add to tabrmd policy interface related with this
|
||||||
|
#https://github.com/tpm2-software/tpm2-abrmd/blob/master/selinux
|
||||||
|
dbus_chat_system_bus(keylime_agent_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
dbus_stream_connect_system_dbusd(keylime_agent_t)
|
||||||
|
dbus_system_bus_client(keylime_agent_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
systemd_userdbd_stream_connect(keylime_agent_t)
|
||||||
|
systemd_machined_stream_connect(keylime_agent_t)
|
||||||
|
')
|
||||||
376
SPECS/keylime.spec
Normal file
376
SPECS/keylime.spec
Normal file
@ -0,0 +1,376 @@
|
|||||||
|
%global srcname keylime
|
||||||
|
%global with_selinux 1
|
||||||
|
%global selinuxtype targeted
|
||||||
|
|
||||||
|
# Package is actually noarch, but it has an optional dependency that is
|
||||||
|
# arch-specific.
|
||||||
|
%global debug_package %{nil}
|
||||||
|
|
||||||
|
Name: keylime
|
||||||
|
Version: 6.5.0
|
||||||
|
Release: 1%{?dist}
|
||||||
|
Summary: Open source TPM software for Bootstrapping and Maintaining Trust
|
||||||
|
|
||||||
|
URL: https://github.com/keylime/keylime
|
||||||
|
Source0: https://github.com/keylime/keylime/archive/refs/tags/v%{version}.tar.gz
|
||||||
|
Source1: %{srcname}.sysusers
|
||||||
|
Source2: %{srcname}.te
|
||||||
|
Source3: %{srcname}.if
|
||||||
|
Source4: %{srcname}.fc
|
||||||
|
|
||||||
|
License: ASL 2.0 and MIT
|
||||||
|
|
||||||
|
BuildRequires: git-core
|
||||||
|
BuildRequires: swig
|
||||||
|
BuildRequires: openssl-devel
|
||||||
|
BuildRequires: python3-devel
|
||||||
|
BuildRequires: python3-dbus
|
||||||
|
BuildRequires: python3-jinja2
|
||||||
|
BuildRequires: python3-setuptools
|
||||||
|
BuildRequires: systemd-rpm-macros
|
||||||
|
|
||||||
|
Requires: python3-%{srcname} = %{version}-%{release}
|
||||||
|
Requires: %{srcname}-base = %{version}-%{release}
|
||||||
|
Requires: %{srcname}-verifier = %{version}-%{release}
|
||||||
|
Requires: %{srcname}-registrar = %{version}-%{release}
|
||||||
|
Requires: %{srcname}-tenant = %{version}-%{release}
|
||||||
|
|
||||||
|
# Agent.
|
||||||
|
Requires: keylime-agent
|
||||||
|
Suggests: keylime-agent-rust
|
||||||
|
|
||||||
|
%{?python_enable_dependency_generator}
|
||||||
|
%description
|
||||||
|
Keylime is a TPM based highly scalable remote boot attestation
|
||||||
|
and runtime integrity measurement solution.
|
||||||
|
|
||||||
|
%package base
|
||||||
|
Summary: The base package contains the default configuration
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
|
||||||
|
Requires(pre): shadow-utils
|
||||||
|
Requires: procps-ng
|
||||||
|
Requires: tpm2-tss
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
# This ensures that the *-selinux package and all it’s dependencies are not pulled
|
||||||
|
# into containers and other systems that do not use SELinux
|
||||||
|
Recommends: (%{srcname}-selinux if selinux-policy-%{selinuxtype})
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%ifarch %efi
|
||||||
|
Requires: efivar-libs
|
||||||
|
%endif
|
||||||
|
|
||||||
|
|
||||||
|
%description base
|
||||||
|
The base package contains the Keylime default configuration
|
||||||
|
|
||||||
|
%package -n python3-%{srcname}
|
||||||
|
Summary: The Python Keylime module
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
Requires: %{srcname}-base = %{version}-%{release}
|
||||||
|
%{?python_provide:%python_provide python3-%{srcname}}
|
||||||
|
|
||||||
|
Requires: python3-tornado
|
||||||
|
Requires: python3-sqlalchemy
|
||||||
|
Requires: python3-alembic
|
||||||
|
Requires: python3-cryptography
|
||||||
|
Requires: python3-pyyaml
|
||||||
|
Requires: python3-packaging
|
||||||
|
Requires: python3-requests
|
||||||
|
Requires: python3-gpg
|
||||||
|
Requires: python3-lark-parser
|
||||||
|
Requires: python3-pyasn1
|
||||||
|
Requires: python3-pyasn1-modules
|
||||||
|
Requires: tpm2-tools
|
||||||
|
|
||||||
|
%description -n python3-%{srcname}
|
||||||
|
The python3-keylime module implements the functionality used
|
||||||
|
by Keylime components.
|
||||||
|
|
||||||
|
%package verifier
|
||||||
|
Summary: The Python Keylime Verifier component
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
Requires: %{srcname}-base = %{version}-%{release}
|
||||||
|
Requires: python3-%{srcname} = %{version}-%{release}
|
||||||
|
|
||||||
|
%description verifier
|
||||||
|
The Keylime Verifier continuously verifies the integrity state
|
||||||
|
of the machine that the agent is running on.
|
||||||
|
|
||||||
|
%package registrar
|
||||||
|
Summary: The Keylime Registrar component
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
Requires: %{srcname}-base = %{version}-%{release}
|
||||||
|
Requires: python3-%{srcname} = %{version}-%{release}
|
||||||
|
|
||||||
|
%description registrar
|
||||||
|
The Keylime Registrar is a database of all agents registered
|
||||||
|
with Keylime and hosts the public keys of the TPM vendors.
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
# SELinux subpackage
|
||||||
|
%package selinux
|
||||||
|
Summary: keylime SELinux policy
|
||||||
|
BuildArch: noarch
|
||||||
|
Requires: selinux-policy-%{selinuxtype}
|
||||||
|
Requires(post): selinux-policy-%{selinuxtype}
|
||||||
|
BuildRequires: selinux-policy-devel
|
||||||
|
%{?selinux_requires}
|
||||||
|
|
||||||
|
%description selinux
|
||||||
|
Custom SELinux policy module
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%package tenant
|
||||||
|
Summary: The Python Keylime Tenant
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
Requires: %{srcname}-base = %{version}-%{release}
|
||||||
|
Requires: python3-%{srcname} = %{version}-%{release}
|
||||||
|
|
||||||
|
|
||||||
|
%description tenant
|
||||||
|
The Keylime Tenant can be used to provision a Keylime Agent.
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -S git -n %{srcname}-%{version}
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
# SELinux policy (originally from selinux-policy-contrib)
|
||||||
|
# this policy module will override the production module
|
||||||
|
mkdir selinux
|
||||||
|
cp -p %{SOURCE2} selinux/
|
||||||
|
cp -p %{SOURCE3} selinux/
|
||||||
|
cp -p %{SOURCE4} selinux/
|
||||||
|
|
||||||
|
make -f %{_datadir}/selinux/devel/Makefile %{srcname}.pp
|
||||||
|
bzip2 -9 %{srcname}.pp
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%build
|
||||||
|
%py3_build
|
||||||
|
|
||||||
|
%install
|
||||||
|
%py3_install
|
||||||
|
mkdir -p %{buildroot}/%{_sharedstatedir}/%{srcname}
|
||||||
|
mkdir -p --mode=0700 %{buildroot}/%{_rundir}/%{srcname}
|
||||||
|
mkdir -p --mode=0700 %{buildroot}/%{_localstatedir}/log/%{srcname}
|
||||||
|
|
||||||
|
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/
|
||||||
|
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||||||
|
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||||||
|
install -Dpm 400 config/${comp}.conf %{buildroot}/%{_sysconfdir}/%{srcname}
|
||||||
|
done
|
||||||
|
|
||||||
|
# Remove agent.
|
||||||
|
rm -f %{buildroot}/%{_bindir}/%{srcname}_agent
|
||||||
|
rm -f %{buildroot}%{python3_sitelib}/%{srcname}/__pycache__/%{srcname}_agent*
|
||||||
|
rm -f %{buildroot}%{python3_sitelib}/%{srcname}/cmd/__pycache__/agent.*
|
||||||
|
rm -f %{buildroot}%{python3_sitelib}/%{srcname}/cmd/agent.*
|
||||||
|
rm -f %{buildroot}%{python3_sitelib}/%{srcname}/%{srcname}_agent.*
|
||||||
|
|
||||||
|
# Remove misc progs.
|
||||||
|
rm -f %{buildroot}/%{_bindir}/%{srcname}_ima_emulator
|
||||||
|
rm -f %{buildroot}/%{_bindir}/%{srcname}_userdata_encrypt
|
||||||
|
|
||||||
|
# Ship some scripts.
|
||||||
|
mkdir -p %{buildroot}/%{_datadir}/%{srcname}/scripts
|
||||||
|
for s in create_allowlist.sh \
|
||||||
|
create_mb_refstate \
|
||||||
|
create_policy; do
|
||||||
|
install -Dpm 755 scripts/${s} \
|
||||||
|
%{buildroot}/%{_datadir}/%{srcname}/scripts/${s}
|
||||||
|
done
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
install -D -m 0644 %{srcname}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||||||
|
install -D -p -m 0644 selinux/%{srcname}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||||||
|
%endif
|
||||||
|
|
||||||
|
|
||||||
|
install -Dpm 644 ./services/%{srcname}_verifier.service \
|
||||||
|
%{buildroot}%{_unitdir}/%{srcname}_verifier.service
|
||||||
|
|
||||||
|
install -Dpm 644 ./services/%{srcname}_registrar.service \
|
||||||
|
%{buildroot}%{_unitdir}/%{srcname}_registrar.service
|
||||||
|
|
||||||
|
cp -r ./tpm_cert_store %{buildroot}%{_sharedstatedir}/%{srcname}/
|
||||||
|
chmod 400 %{buildroot}%{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem
|
||||||
|
|
||||||
|
install -p -d %{buildroot}/%{_tmpfilesdir}
|
||||||
|
cat > %{buildroot}/%{_tmpfilesdir}/%{srcname}.conf << EOF
|
||||||
|
d %{_rundir}/%{srcname} 0700 %{srcname} %{srcname} -
|
||||||
|
EOF
|
||||||
|
|
||||||
|
install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/%{srcname}.conf
|
||||||
|
|
||||||
|
%pre base
|
||||||
|
%sysusers_create_compat %{SOURCE1}
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%posttrans base
|
||||||
|
if [ -d %{_sysconfdir}/%{srcname} ]; then
|
||||||
|
chmod 500 %{_sysconfdir}/%{srcname}
|
||||||
|
chown -R %{srcname}:%{srcname} %{_sysconfdir}/%{srcname}
|
||||||
|
|
||||||
|
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||||||
|
[ -d %{_sysconfdir}/%{srcname}/${comp}.conf.d ] && \
|
||||||
|
chmod 500 %{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
[ -d %{_sharedstatedir}/%{srcname} ] && \
|
||||||
|
chown -R %{srcname} %{_sharedstatedir}/%{srcname}/
|
||||||
|
|
||||||
|
[ -d %{_sharedstatedir}/%{srcname}/tpm_cert_store ] && \
|
||||||
|
chmod 400 %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem && \
|
||||||
|
chmod 500 %{_sharedstatedir}/%{srcname}/tpm_cert_store/
|
||||||
|
|
||||||
|
[ -d %{_localstatedir}/log/%{srcname} ] && \
|
||||||
|
chown -R %{srcname} %{_localstatedir}/log/%{srcname}/
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%post verifier
|
||||||
|
%systemd_post %{srcname}_verifier.service
|
||||||
|
|
||||||
|
%post registrar
|
||||||
|
%systemd_post %{srcname}_registrar.service
|
||||||
|
|
||||||
|
%preun verifier
|
||||||
|
%systemd_preun %{srcname}_verifier.service
|
||||||
|
|
||||||
|
%preun registrar
|
||||||
|
%systemd_preun %{srcname}_registrar.service
|
||||||
|
|
||||||
|
%postun verifier
|
||||||
|
%systemd_postun_with_restart %{srcname}_verifier.service
|
||||||
|
|
||||||
|
%postun registrar
|
||||||
|
%systemd_postun_with_restart %{srcname}_registrar.service
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
# SELinux contexts are saved so that only affected files can be
|
||||||
|
# relabeled after the policy module installation
|
||||||
|
%pre selinux
|
||||||
|
%selinux_relabel_pre -s %{selinuxtype}
|
||||||
|
|
||||||
|
%post selinux
|
||||||
|
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||||||
|
%selinux_relabel_post -s %{selinuxtype}
|
||||||
|
|
||||||
|
if [ "$1" -le "1" ]; then # First install
|
||||||
|
# The services need to be restarted for the custom label to be
|
||||||
|
# applied in case they where already present in the system,
|
||||||
|
# restart fails silently in case they where not.
|
||||||
|
for svc in agent registrar verifier; do
|
||||||
|
[ -f "%{_unitdir}/%{srcname}_${svc}".service ] && \
|
||||||
|
%systemd_postun_with_restart "%{srcname}_${svc}".service
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%postun selinux
|
||||||
|
if [ $1 -eq 0 ]; then
|
||||||
|
%selinux_modules_uninstall -s %{selinuxtype} %{srcname}
|
||||||
|
%selinux_relabel_post -s %{selinuxtype}
|
||||||
|
fi
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files verifier
|
||||||
|
%license LICENSE
|
||||||
|
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/verifier.conf.d
|
||||||
|
%config(noreplace) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/verifier.conf
|
||||||
|
%{_bindir}/%{srcname}_verifier
|
||||||
|
%{_bindir}/%{srcname}_ca
|
||||||
|
%{_bindir}/%{srcname}_migrations_apply
|
||||||
|
%{_unitdir}/keylime_verifier.service
|
||||||
|
|
||||||
|
%files registrar
|
||||||
|
%license LICENSE
|
||||||
|
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/registrar.conf.d
|
||||||
|
%config(noreplace) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/registrar.conf
|
||||||
|
%{_bindir}/%{srcname}_registrar
|
||||||
|
%{_unitdir}/keylime_registrar.service
|
||||||
|
|
||||||
|
%if 0%{?with_selinux}
|
||||||
|
%files selinux
|
||||||
|
%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.*
|
||||||
|
%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||||||
|
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{srcname}
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files tenant
|
||||||
|
%license LICENSE
|
||||||
|
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/tenant.conf.d
|
||||||
|
%config(noreplace) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/tenant.conf
|
||||||
|
%{_bindir}/%{srcname}_tenant
|
||||||
|
|
||||||
|
%files -n python3-%{srcname}
|
||||||
|
%license LICENSE
|
||||||
|
%{python3_sitelib}/%{srcname}-*.egg-info/
|
||||||
|
%{python3_sitelib}/%{srcname}
|
||||||
|
%{_datadir}/%{srcname}/scripts/create_mb_refstate
|
||||||
|
%{_datadir}/%{srcname}/scripts/create_policy
|
||||||
|
|
||||||
|
%files base
|
||||||
|
%license LICENSE
|
||||||
|
%doc README.md
|
||||||
|
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/{ca,logging}.conf.d
|
||||||
|
%config(noreplace) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/ca.conf
|
||||||
|
%config(noreplace) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/logging.conf
|
||||||
|
%attr(700,%{srcname},%{srcname}) %dir %{_rundir}/%{srcname}
|
||||||
|
%attr(700,%{srcname},%{srcname}) %dir %{_localstatedir}/log/%{srcname}
|
||||||
|
%attr(700,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}
|
||||||
|
%attr(500,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}/tpm_cert_store
|
||||||
|
%attr(400,%{srcname},%{srcname}) %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem
|
||||||
|
%{_tmpfilesdir}/%{srcname}.conf
|
||||||
|
%{_sysusersdir}/%{srcname}.conf
|
||||||
|
%{_datadir}/%{srcname}/scripts/create_allowlist.sh
|
||||||
|
|
||||||
|
%files
|
||||||
|
%license LICENSE
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Tue Sep 13 2022 Sergio Correia <scorreia@redhat.com> - 6.5.0-1
|
||||||
|
- Update to 6.5.0
|
||||||
|
Resolves: rhbz#2120686 - Keylime configuration is too complex
|
||||||
|
|
||||||
|
* Fri Aug 26 2022 Sergio Correia <scorreia@redhat.com> - 6.4.3-1
|
||||||
|
- Update to 6.4.3
|
||||||
|
Resolves: rhbz#2121044 - Error parsing EK ASN.1 certificate of Nuvoton HW TPM
|
||||||
|
|
||||||
|
* Fri Aug 26 2022 Patrik Koncity <pkoncity@redhat.com> - 6.4.2-6
|
||||||
|
- Update keylime SELinux policy
|
||||||
|
- Resolves: rhbz#2121058
|
||||||
|
|
||||||
|
* Fri Aug 26 2022 Patrik Koncity <pkoncity@redhat.com> - 6.4.2-5
|
||||||
|
- Update keylime SELinux policy and removed duplicate rules
|
||||||
|
- Resolves: rhbz#2121058
|
||||||
|
|
||||||
|
* Fri Aug 26 2022 Patrik Koncity <pkoncity@redhat.com> - 6.4.2-4
|
||||||
|
- Update keylime SELinux policy
|
||||||
|
- Resolves: rhbz#2121058
|
||||||
|
|
||||||
|
* Wed Aug 17 2022 Patrik Koncity <pkoncity@redhat.com> - 6.4.2-3
|
||||||
|
- Add keylime-selinux policy as subpackage
|
||||||
|
- See https://fedoraproject.org/wiki/SELinux/IndependentPolicy
|
||||||
|
- Resolves: rhbz#2121058
|
||||||
|
|
||||||
|
* Mon Jul 11 2022 Sergio Correia <scorreia@redhat.com> - 6.4.2-2
|
||||||
|
- Fix efivar-libs dependency
|
||||||
|
Related: rhbz#2082989
|
||||||
|
|
||||||
|
* Thu Jul 07 2022 Sergio Correia <scorreia@redhat.com> - 6.4.2-1
|
||||||
|
- Update to 6.4.2
|
||||||
|
Related: rhbz#2082989
|
||||||
|
|
||||||
|
* Tue Jun 21 2022 Sergio Correia <scorreia@redhat.com> - 6.4.1-1
|
||||||
|
- Add keylime to RHEL-9
|
||||||
|
Resolves: rhbz#2082989
|
||||||
Loading…
Reference in New Issue
Block a user