d7b9d5aca9
Resolves: RHEL-153121 Backport upstream PR https://github.com/keylime/keylime/pull/1874 to fix a race condition in the pull-mode DELETE handler where an agent could be deleted from the database while an in-flight attestation cycle was still running, causing 'tenant -c update' to intermittently fail with "Agent was not deleted from Verifier after 5 tries". Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
482 lines
16 KiB
RPMSpec
482 lines
16 KiB
RPMSpec
%global srcname keylime
|
||
%global policy_version 43.1.1
|
||
|
||
# Package is actually noarch, but it has an optional dependency that is
|
||
# arch-specific.
|
||
%global debug_package %{nil}
|
||
%global with_selinux 1
|
||
%global selinuxtype targeted
|
||
|
||
Name: keylime
|
||
Version: 7.14.1
|
||
Release: 4%{?dist}
|
||
Summary: Open source TPM software for Bootstrapping and Maintaining Trust
|
||
|
||
URL: https://github.com/keylime/keylime
|
||
Source0: https://github.com/keylime/keylime/archive/refs/tags/v%{version}.tar.gz
|
||
# The selinux policy for keylime is distributed via this repo: https://github.com/RedHat-SP-Security/keylime-selinux
|
||
Source1: https://github.com/RedHat-SP-Security/%{name}-selinux/archive/v%{policy_version}/keylime-selinux-%{policy_version}.tar.gz
|
||
Source2: %{srcname}.sysusers
|
||
Source3: %{srcname}.tmpfiles
|
||
|
||
Patch: 0001-Fix-timestamp-conversion-to-use-UTC-timezone.patch
|
||
Patch: 0002-Fix-efivar-availability-check-in-test_create_mb_poli.patch
|
||
Patch: 0003-Close-DB-sessions-to-prevent-connection-exhaustion.patch
|
||
Patch: 0004-Include-thread-safe-session-management.patch
|
||
Patch: 0005-Address-some-improvements-from-code-review.patch
|
||
Patch: 0006-Fix-race-condition-on-in-SessionManager.patch
|
||
Patch: 0007-Fix-linter-errors-in-PersistableModel.get-and-.all.patch
|
||
Patch: 0008-refactor-Remove-dead-code-AuthSession.authenticate_a.patch
|
||
Patch: 0009-db-Clean-up-scoped-session-after-each-request.patch
|
||
Patch: 0010-fix-Check-active-flag-in-_extract_identity-and-guard.patch
|
||
Patch: 0011-fix-Add-fork-safety-to-DBManager-via-dispose.patch
|
||
|
||
# RHEL-154295 - memleaks in verifier push-mode.
|
||
# Backport https://github.com/keylime/keylime/pull/1866
|
||
Patch: 0012-fix-mem-leak-remove-unbounded-functools.cache-from-l.patch
|
||
|
||
# RHEL-153121 - fix verifier race condition on agent delete.
|
||
# Backport https://github.com/keylime/keylime/pulls/1874
|
||
Patch: 0013-fix-verifier-race-condition-on-agent-delete.patch
|
||
|
||
# Main program: Apache-2.0
|
||
# Icons: MIT
|
||
License: Apache-2.0 AND MIT
|
||
|
||
BuildRequires: git-core
|
||
BuildRequires: openssl
|
||
BuildRequires: openssl-devel
|
||
BuildRequires: python3-devel
|
||
BuildRequires: python3-dbus
|
||
BuildRequires: python3-jinja2
|
||
BuildRequires: python3-cryptography
|
||
BuildRequires: python3-docutils
|
||
BuildRequires: python3-gpg
|
||
BuildRequires: python3-pyasn1
|
||
BuildRequires: python3-pyasn1-modules
|
||
BuildRequires: python3-requests
|
||
BuildRequires: python3-tornado
|
||
BuildRequires: python3-sqlalchemy
|
||
BuildRequires: python3-lark
|
||
BuildRequires: python3-psutil
|
||
BuildRequires: python3-pyyaml
|
||
BuildRequires: python3-jsonschema
|
||
BuildRequires: python3-setuptools
|
||
BuildRequires: systemd-rpm-macros
|
||
BuildRequires: rpm-sign
|
||
BuildRequires: createrepo_c
|
||
BuildRequires: tpm2-tools
|
||
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: %{srcname}-verifier = %{version}-%{release}
|
||
Requires: %{srcname}-registrar = %{version}-%{release}
|
||
Requires: %{srcname}-tenant = %{version}-%{release}
|
||
Requires: %{srcname}-tools = %{version}-%{release}
|
||
|
||
# webapp was removed upstream in release 6.4.2.
|
||
Obsoletes: %{srcname}-webapp < 6.4.2
|
||
|
||
# python agent was removed upstream in release 7.0.0.
|
||
Obsoletes: python3-%{srcname}-agent < 7.0.0
|
||
|
||
# Agent.
|
||
Requires: keylime-agent
|
||
Suggests: %{srcname}-agent-rust
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
%{?python_enable_dependency_generator}
|
||
%description
|
||
Keylime is a TPM based highly scalable remote boot attestation
|
||
and runtime integrity measurement solution.
|
||
|
||
%package base
|
||
Summary: The base package contains the default configuration
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires(pre): python3-jinja2
|
||
Requires(pre): shadow-utils
|
||
Requires(pre): tpm2-tss
|
||
Requires: procps-ng
|
||
Requires: openssl
|
||
|
||
%if 0%{?with_selinux}
|
||
# This ensures that the *-selinux package and all it’s dependencies are not pulled
|
||
# into containers and other systems that do not use SELinux
|
||
Recommends: (%{srcname}-selinux if selinux-policy-%{selinuxtype})
|
||
%endif
|
||
|
||
%ifarch %efi
|
||
BuildRequires: efivar-libs
|
||
Requires: efivar-libs
|
||
%endif
|
||
|
||
|
||
%description base
|
||
The base package contains the Keylime default configuration
|
||
|
||
%package -n python3-%{srcname}
|
||
Summary: The Python Keylime module
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
%{?python_provide:%python_provide python3-%{srcname}}
|
||
|
||
Requires: python3-tornado
|
||
Requires: python3-sqlalchemy
|
||
Requires: python3-alembic
|
||
Requires: python3-cryptography
|
||
Requires: python3-pyyaml
|
||
Requires: python3-packaging
|
||
Requires: python3-requests
|
||
Requires: python3-gpg
|
||
Requires: python3-lark-parser
|
||
Requires: python3-pyasn1
|
||
Requires: python3-pyasn1-modules
|
||
requires: python3-psutil
|
||
Requires: python3-jsonschema
|
||
Requires: python3-typing-extensions
|
||
Requires: tpm2-tools
|
||
|
||
%description -n python3-%{srcname}
|
||
The python3-keylime module implements the functionality used
|
||
by Keylime components.
|
||
|
||
%package verifier
|
||
Summary: The Python Keylime Verifier component
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description verifier
|
||
The Keylime Verifier continuously verifies the integrity state
|
||
of the machine that the agent is running on.
|
||
|
||
%package registrar
|
||
Summary: The Keylime Registrar component
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description registrar
|
||
The Keylime Registrar is a database of all agents registered
|
||
with Keylime and hosts the public keys of the TPM vendors.
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux subpackage
|
||
%package selinux
|
||
Summary: keylime SELinux policy
|
||
BuildArch: noarch
|
||
Requires: selinux-policy-%{selinuxtype}
|
||
Requires(post): selinux-policy-%{selinuxtype}
|
||
BuildRequires: selinux-policy-devel
|
||
%{?selinux_requires}
|
||
|
||
%description selinux
|
||
Custom SELinux policy module
|
||
%endif
|
||
|
||
%package tenant
|
||
Summary: The Python Keylime Tenant
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
|
||
%description tenant
|
||
The Keylime Tenant can be used to provision a Keylime Agent.
|
||
|
||
%package tools
|
||
Summary: Keylime tools
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description tools
|
||
The keylime tools package includes miscelaneous tools.
|
||
|
||
|
||
%prep
|
||
%autosetup -S git -n %{srcname}-%{version} -a1
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux policy (originally from selinux-policy-contrib)
|
||
# this policy module will override the production module
|
||
|
||
make -f %{_datadir}/selinux/devel/Makefile %{srcname}.pp
|
||
bzip2 -9 %{srcname}.pp
|
||
%endif
|
||
|
||
%build
|
||
%py3_build
|
||
|
||
mkdir -p manpages
|
||
rst2man --syntax-highlight=none docs/man/keylime_tenant.1.rst manpages/keylime_tenant.1
|
||
rst2man --syntax-highlight=none docs/man/keylime-policy.1.rst manpages/keylime-policy.1
|
||
rst2man --syntax-highlight=none docs/man/keylime_registrar.8.rst manpages/keylime_registrar.8
|
||
rst2man --syntax-highlight=none docs/man/keylime_verifier.8.rst manpages/keylime_verifier.8
|
||
|
||
%install
|
||
%py3_install
|
||
mkdir -p %{buildroot}/%{_sharedstatedir}/%{srcname}
|
||
mkdir -p --mode=0700 %{buildroot}/%{_rundir}/%{srcname}
|
||
|
||
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/
|
||
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||
install -Dpm 400 config/${comp}.conf %{buildroot}/%{_sysconfdir}/%{srcname}
|
||
done
|
||
|
||
# Do not ship a few scripts that are to be obsoleted soon.
|
||
# The functionality they provide is now provided by keylime-policy.
|
||
for s in keylime_convert_runtime_policy \
|
||
keylime_create_policy \
|
||
keylime_sign_runtime_policy; do
|
||
rm -f %{buildroot}/%{_bindir}/"${s}"
|
||
done
|
||
|
||
# Ship the ek-openssl-verify script.
|
||
mkdir -p %{buildroot}/%{_datadir}/%{srcname}/scripts
|
||
for s in ek-openssl-verify keylime_oneshot_attestation; do
|
||
install -Dpm 755 scripts/"${s}" \
|
||
%{buildroot}/%{_datadir}/%{srcname}/scripts/"${s}"
|
||
done
|
||
|
||
# Ship configuration templates.
|
||
cp -r ./templates %{buildroot}%{_datadir}/%{srcname}/templates/
|
||
|
||
mkdir -p --mode=0755 %{buildroot}/%{_bindir}
|
||
install -Dpm 755 ./keylime/cmd/convert_config.py %{buildroot}/%{_bindir}/keylime_upgrade_config
|
||
|
||
%if 0%{?with_selinux}
|
||
install -D -m 0644 %{srcname}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||
install -D -p -m 0644 keylime-selinux-%{policy_version}/%{srcname}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||
%endif
|
||
|
||
install -Dpm 644 ./services/%{srcname}_verifier.service \
|
||
%{buildroot}%{_unitdir}/%{srcname}_verifier.service
|
||
|
||
install -Dpm 644 ./services/%{srcname}_registrar.service \
|
||
%{buildroot}%{_unitdir}/%{srcname}_registrar.service
|
||
|
||
# TPM cert store is deployed to both /usr/share/keylime/tpm_cert_store
|
||
# and then /var/lib/keylime/tpm_cert_store.
|
||
for cert_store_dir in %{_datadir} %{_sharedstatedir}; do
|
||
mkdir -p %{buildroot}/"${cert_store_dir}"/%{srcname}
|
||
cp -r ./tpm_cert_store %{buildroot}/"${cert_store_dir}"/%{srcname}/
|
||
done
|
||
|
||
# Install the sysusers + tmpfiles.d configuration.
|
||
install -p -D -m 0644 %{SOURCE2} %{buildroot}/%{_sysusersdir}/%{srcname}.conf
|
||
install -p -D -m 0644 %{SOURCE3} %{buildroot}/%{_tmpfilesdir}/%{name}.conf
|
||
|
||
# Install manpages
|
||
install -d %{buildroot}%{_mandir}/man1
|
||
install -d %{buildroot}%{_mandir}/man8
|
||
install -m 644 manpages/keylime_tenant.1 %{buildroot}%{_mandir}/man1/
|
||
install -m 644 manpages/keylime-policy.1 %{buildroot}%{_mandir}/man1/
|
||
install -m 644 manpages/keylime_registrar.8 %{buildroot}%{_mandir}/man8/
|
||
install -m 644 manpages/keylime_verifier.8 %{buildroot}%{_mandir}/man8/
|
||
|
||
%check
|
||
# Create the default configuration files to be used by the tests.
|
||
# Also set the associated environment variables so that the tests
|
||
# will actually use them.
|
||
CONF_TEMP_DIR="$(mktemp -d)"
|
||
|
||
%{python3} -m keylime.cmd.convert_config --out "${CONF_TEMP_DIR}" --templates templates/
|
||
export KEYLIME_VERIFIER_CONFIG="${CONF_TEMP_DIR}/verifier.conf"
|
||
export KEYLIME_TENANT_CONFIG="${CONF_TEMP_DIR}/tenant.conf"
|
||
export KEYLIME_REGISTRAR_CONFIG="${CONF_TEMP_DIR}/registrar.conf"
|
||
export KEYLIME_CA_CONFIG="${CONF_TEMP_DIR}/ca.conf"
|
||
export KEYLIME_LOGGING_CONFIG="${CONF_TEMP_DIR}/logging.conf"
|
||
|
||
# Run the tests.
|
||
%{python3} -m unittest
|
||
|
||
# Cleanup.
|
||
[ "${CONF_TEMP_DIR}" ] && rm -rf "${CONF_TEMP_DIR}"
|
||
for e in KEYLIME_VERIFIER_CONFIG \
|
||
KEYLIME_TENANT_CONFIG \
|
||
KEYLIME_REGISTRAR_CONFIG \
|
||
KEYLIME_CA_CONFIG \
|
||
KEYLIME_LOGGING_CONFIG; do
|
||
unset "${e}"
|
||
done
|
||
exit 0
|
||
|
||
%pre base
|
||
%sysusers_create_compat %{SOURCE2}
|
||
exit 0
|
||
|
||
%post base
|
||
/usr/bin/keylime_upgrade_config --component ca --component logging >/dev/null
|
||
exit 0
|
||
|
||
%posttrans base
|
||
if [ -d %{_sysconfdir}/%{srcname} ]; then
|
||
chmod 500 %{_sysconfdir}/%{srcname}
|
||
chown -R %{srcname}:%{srcname} %{_sysconfdir}/%{srcname}
|
||
|
||
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||
[ -d %{_sysconfdir}/%{srcname}/${comp}.conf.d ] && \
|
||
chmod 500 %{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||
done
|
||
fi
|
||
|
||
[ -d %{_sharedstatedir}/%{srcname} ] && \
|
||
chown -R %{srcname} %{_sharedstatedir}/%{srcname}/
|
||
|
||
[ -d %{_sharedstatedir}/%{srcname}/tpm_cert_store ] && \
|
||
chmod 400 %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem && \
|
||
chmod 500 %{_sharedstatedir}/%{srcname}/tpm_cert_store/
|
||
|
||
%post verifier
|
||
/usr/bin/keylime_upgrade_config --component verifier >/dev/null
|
||
%systemd_post %{srcname}_verifier.service
|
||
|
||
%post registrar
|
||
/usr/bin/keylime_upgrade_config --component registrar >/dev/null
|
||
%systemd_post %{srcname}_registrar.service
|
||
|
||
%post tenant
|
||
/usr/bin/keylime_upgrade_config --component tenant >/dev/null
|
||
exit 0
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux contexts are saved so that only affected files can be
|
||
# relabeled after the policy module installation
|
||
%pre selinux
|
||
%selinux_relabel_pre -s %{selinuxtype}
|
||
|
||
%post selinux
|
||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||
%selinux_relabel_post -s %{selinuxtype}
|
||
|
||
if [ "$1" -le "1" ]; then # First install
|
||
# The services need to be restarted for the custom label to be
|
||
# applied in case they where already present in the system,
|
||
# restart fails silently in case they where not.
|
||
for svc in registrar verifier; do
|
||
[ -f "%{_unitdir}/%{srcname}_${svc}".service ] && \
|
||
%systemd_postun_with_restart "%{srcname}_${svc}".service
|
||
done
|
||
fi
|
||
exit 0
|
||
|
||
%postun selinux
|
||
if [ $1 -eq 0 ]; then
|
||
%selinux_modules_uninstall -s %{selinuxtype} %{srcname}
|
||
%selinux_relabel_post -s %{selinuxtype}
|
||
fi
|
||
%endif
|
||
|
||
%preun verifier
|
||
%systemd_preun %{srcname}_verifier.service
|
||
|
||
%preun registrar
|
||
%systemd_preun %{srcname}_registrar.service
|
||
|
||
%preun tenant
|
||
%systemd_preun %{srcname}_registrar.service
|
||
|
||
%postun verifier
|
||
%systemd_postun_with_restart %{srcname}_verifier.service
|
||
|
||
%postun registrar
|
||
%systemd_postun_with_restart %{srcname}_registrar.service
|
||
|
||
%files verifier
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/verifier.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/verifier.conf
|
||
%{_bindir}/%{srcname}_verifier
|
||
%{_bindir}/%{srcname}_ca
|
||
%{_unitdir}/keylime_verifier.service
|
||
%{_mandir}/man8/keylime_verifier.8*
|
||
|
||
%files registrar
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/registrar.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/registrar.conf
|
||
%{_bindir}/%{srcname}_registrar
|
||
%{_unitdir}/keylime_registrar.service
|
||
%{_mandir}/man8/keylime_registrar.8*
|
||
|
||
%if 0%{?with_selinux}
|
||
%files selinux
|
||
%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.*
|
||
%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{srcname}
|
||
%endif
|
||
|
||
%files tenant
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/tenant.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/tenant.conf
|
||
%{_bindir}/%{srcname}_tenant
|
||
%{_mandir}/man1/keylime_tenant.1*
|
||
|
||
%files -n python3-%{srcname}
|
||
%license LICENSE
|
||
%{python3_sitelib}/%{srcname}-*.egg-info/
|
||
%{python3_sitelib}/%{srcname}
|
||
%{_bindir}/keylime_attest
|
||
%{_bindir}/keylime-policy
|
||
%{_mandir}/man1/keylime-policy.1*
|
||
|
||
|
||
%files tools
|
||
%license LICENSE
|
||
%{_bindir}/%{srcname}_userdata_encrypt
|
||
|
||
%files base
|
||
%license LICENSE
|
||
%doc README.md
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/{ca,logging}.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/ca.conf
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/logging.conf
|
||
%attr(700,%{srcname},%{srcname}) %dir %{_rundir}/%{srcname}
|
||
%attr(700,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}
|
||
%attr(755,root,root) %dir %{_datadir}/%{srcname}/tpm_cert_store
|
||
%attr(644,root,root) %{_datadir}/%{srcname}/tpm_cert_store/*.pem
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}/tpm_cert_store
|
||
%attr(400,%{srcname},%{srcname}) %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem
|
||
%{_tmpfilesdir}/%{srcname}.conf
|
||
%{_sysusersdir}/%{srcname}.conf
|
||
%{_datadir}/%{srcname}/scripts/ek-openssl-verify
|
||
%{_datadir}/%{srcname}/scripts/keylime_oneshot_attestation
|
||
%{_datadir}/%{srcname}/templates
|
||
%{_bindir}/keylime_upgrade_config
|
||
|
||
%files
|
||
%license LICENSE
|
||
|
||
%changelog
|
||
%autochangelog
|