eca2d398c1
The included patches implement graceful shutdown for both pull and push models, cancelling pending operations, and waiting for critical in-flight operations to finish before shutting down. Backport the following upstream PRs: - https://github.com/keylime/keylime/pull/1809 - Document supported configuration options - Sync missing and removed options from configuration templates - https://github.com/keylime/keylime/pull/1868 - Remove 'enable_authentication' from agent config templates - https://github.com/keylime/keylime/pull/1855 - Add push-model documentation - https://github.com/keylime/keylime/pull/1869 - Add verifier graceful shutdown - https://github.com/keylime/keylime/pull/1883 - Ignore SIGTERM and SIGINT signals on Manager and parent processes - https://github.com/keylime/keylime/pull/1886 - Move socket from /tmp to /var/run/keylime Also, update the keylime-selinux to the latest release (43.2.1) to include the following changes: - https://github.com/RedHat-SP-Security/keylime-selinux/pull/33 - Allow Keylime to perform socket operation on /var/run/keylime - https://github.com/RedHat-SP-Security/keylime-selinux/pull/34 - Allow Keylime to read /proc/net to populate certificates Subject Alternative Names (SAN) Documentation updates and configuration template updates were included to allow the graceful shutdown patch to apply cleanly. This also modifies the test runner to use pytest, adding python3-pytest to the BuildRequires. This was necessary to make the fixtures created in conftest.py to be used, which is not available when running with unittest. Resolves: RHEL-151493 Resolves: RHEL-151408 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
498 lines
16 KiB
RPMSpec
498 lines
16 KiB
RPMSpec
%global srcname keylime
|
||
%global policy_version 43.2.1
|
||
|
||
# Package is actually noarch, but it has an optional dependency that is
|
||
# arch-specific.
|
||
%global debug_package %{nil}
|
||
%global with_selinux 1
|
||
%global selinuxtype targeted
|
||
|
||
Name: keylime
|
||
Version: 7.14.1
|
||
Release: 5%{?dist}
|
||
Summary: Open source TPM software for Bootstrapping and Maintaining Trust
|
||
|
||
URL: https://github.com/keylime/keylime
|
||
Source0: https://github.com/keylime/keylime/archive/refs/tags/v%{version}.tar.gz
|
||
# The selinux policy for keylime is distributed via this repo: https://github.com/RedHat-SP-Security/keylime-selinux
|
||
Source1: https://github.com/RedHat-SP-Security/%{name}-selinux/archive/v%{policy_version}/keylime-selinux-%{policy_version}.tar.gz
|
||
Source2: %{srcname}.sysusers
|
||
Source3: %{srcname}.tmpfiles
|
||
|
||
Patch: 0001-Fix-timestamp-conversion-to-use-UTC-timezone.patch
|
||
Patch: 0002-Fix-efivar-availability-check-in-test_create_mb_poli.patch
|
||
Patch: 0003-Close-DB-sessions-to-prevent-connection-exhaustion.patch
|
||
Patch: 0004-Include-thread-safe-session-management.patch
|
||
Patch: 0005-Address-some-improvements-from-code-review.patch
|
||
Patch: 0006-Fix-race-condition-on-in-SessionManager.patch
|
||
Patch: 0007-Fix-linter-errors-in-PersistableModel.get-and-.all.patch
|
||
Patch: 0008-refactor-Remove-dead-code-AuthSession.authenticate_a.patch
|
||
Patch: 0009-db-Clean-up-scoped-session-after-each-request.patch
|
||
Patch: 0010-fix-Check-active-flag-in-_extract_identity-and-guard.patch
|
||
Patch: 0011-fix-Add-fork-safety-to-DBManager-via-dispose.patch
|
||
|
||
# RHEL-154295 - memleaks in verifier push-mode.
|
||
# Backport https://github.com/keylime/keylime/pull/1866
|
||
Patch: 0012-fix-mem-leak-remove-unbounded-functools.cache-from-l.patch
|
||
|
||
# RHEL-153121 - fix verifier race condition on agent delete.
|
||
# Backport https://github.com/keylime/keylime/pulls/1874
|
||
Patch: 0013-fix-verifier-race-condition-on-agent-delete.patch
|
||
|
||
# RHEL-151493 - verifier graceful shutdown.
|
||
# Backport:
|
||
# - https://github.com/keylime/keylime/pull/1809
|
||
# - https://github.com/keylime/keylime/pull/1868
|
||
# - https://github.com/keylime/keylime/pull/1855
|
||
# - https://github.com/keylime/keylime/pull/1869
|
||
# - https://github.com/keylime/keylime/pull/1883
|
||
# - https://github.com/keylime/keylime/pull/1886
|
||
Patch: 0014-push-attestation-documentation.patch
|
||
Patch: 0015-remove-enable-authentication-config-option.patch
|
||
Patch: 0016-docs-push-attestation-config-tables.patch
|
||
Patch: 0017-verifier-graceful-shutdown.patch
|
||
Patch: 0018-ignore-sigterm-sigint-manager-parent-processes.patch
|
||
Patch: 0019-move-socket-var-run.patch
|
||
|
||
# Main program: Apache-2.0
|
||
# Icons: MIT
|
||
License: Apache-2.0 AND MIT
|
||
|
||
BuildRequires: git-core
|
||
BuildRequires: openssl
|
||
BuildRequires: openssl-devel
|
||
BuildRequires: python3-devel
|
||
BuildRequires: python3-dbus
|
||
BuildRequires: python3-jinja2
|
||
BuildRequires: python3-cryptography
|
||
BuildRequires: python3-docutils
|
||
BuildRequires: python3-gpg
|
||
BuildRequires: python3-pyasn1
|
||
BuildRequires: python3-pyasn1-modules
|
||
BuildRequires: python3-requests
|
||
BuildRequires: python3-tornado
|
||
BuildRequires: python3-sqlalchemy
|
||
BuildRequires: python3-lark
|
||
BuildRequires: python3-psutil
|
||
BuildRequires: python3-pytest
|
||
BuildRequires: python3-pyyaml
|
||
BuildRequires: python3-jsonschema
|
||
BuildRequires: python3-setuptools
|
||
BuildRequires: systemd-rpm-macros
|
||
BuildRequires: rpm-sign
|
||
BuildRequires: createrepo_c
|
||
BuildRequires: tpm2-tools
|
||
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: %{srcname}-verifier = %{version}-%{release}
|
||
Requires: %{srcname}-registrar = %{version}-%{release}
|
||
Requires: %{srcname}-tenant = %{version}-%{release}
|
||
Requires: %{srcname}-tools = %{version}-%{release}
|
||
|
||
# webapp was removed upstream in release 6.4.2.
|
||
Obsoletes: %{srcname}-webapp < 6.4.2
|
||
|
||
# python agent was removed upstream in release 7.0.0.
|
||
Obsoletes: python3-%{srcname}-agent < 7.0.0
|
||
|
||
# Agent.
|
||
Requires: keylime-agent
|
||
Suggests: %{srcname}-agent-rust
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
%{?python_enable_dependency_generator}
|
||
%description
|
||
Keylime is a TPM based highly scalable remote boot attestation
|
||
and runtime integrity measurement solution.
|
||
|
||
%package base
|
||
Summary: The base package contains the default configuration
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires(pre): python3-jinja2
|
||
Requires(pre): shadow-utils
|
||
Requires(pre): tpm2-tss
|
||
Requires: procps-ng
|
||
Requires: openssl
|
||
|
||
%if 0%{?with_selinux}
|
||
# This ensures that the *-selinux package and all it’s dependencies are not pulled
|
||
# into containers and other systems that do not use SELinux
|
||
Recommends: (%{srcname}-selinux if selinux-policy-%{selinuxtype})
|
||
%endif
|
||
|
||
%ifarch %efi
|
||
BuildRequires: efivar-libs
|
||
Requires: efivar-libs
|
||
%endif
|
||
|
||
|
||
%description base
|
||
The base package contains the Keylime default configuration
|
||
|
||
%package -n python3-%{srcname}
|
||
Summary: The Python Keylime module
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
%{?python_provide:%python_provide python3-%{srcname}}
|
||
|
||
Requires: python3-tornado
|
||
Requires: python3-sqlalchemy
|
||
Requires: python3-alembic
|
||
Requires: python3-cryptography
|
||
Requires: python3-pyyaml
|
||
Requires: python3-packaging
|
||
Requires: python3-requests
|
||
Requires: python3-gpg
|
||
Requires: python3-lark-parser
|
||
Requires: python3-pyasn1
|
||
Requires: python3-pyasn1-modules
|
||
requires: python3-psutil
|
||
Requires: python3-jsonschema
|
||
Requires: python3-typing-extensions
|
||
Requires: tpm2-tools
|
||
|
||
%description -n python3-%{srcname}
|
||
The python3-keylime module implements the functionality used
|
||
by Keylime components.
|
||
|
||
%package verifier
|
||
Summary: The Python Keylime Verifier component
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description verifier
|
||
The Keylime Verifier continuously verifies the integrity state
|
||
of the machine that the agent is running on.
|
||
|
||
%package registrar
|
||
Summary: The Keylime Registrar component
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description registrar
|
||
The Keylime Registrar is a database of all agents registered
|
||
with Keylime and hosts the public keys of the TPM vendors.
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux subpackage
|
||
%package selinux
|
||
Summary: keylime SELinux policy
|
||
BuildArch: noarch
|
||
Requires: selinux-policy-%{selinuxtype}
|
||
Requires(post): selinux-policy-%{selinuxtype}
|
||
BuildRequires: selinux-policy-devel
|
||
%{?selinux_requires}
|
||
|
||
%description selinux
|
||
Custom SELinux policy module
|
||
%endif
|
||
|
||
%package tenant
|
||
Summary: The Python Keylime Tenant
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
|
||
%description tenant
|
||
The Keylime Tenant can be used to provision a Keylime Agent.
|
||
|
||
%package tools
|
||
Summary: Keylime tools
|
||
License: MIT
|
||
|
||
# Conflicts with the monolithic versions of the package, before the split.
|
||
Conflicts: keylime < 6.3.0-3
|
||
|
||
Requires: %{srcname}-base = %{version}-%{release}
|
||
Requires: python3-%{srcname} = %{version}-%{release}
|
||
|
||
%description tools
|
||
The keylime tools package includes miscelaneous tools.
|
||
|
||
|
||
%prep
|
||
%autosetup -S git -n %{srcname}-%{version} -a1
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux policy (originally from selinux-policy-contrib)
|
||
# this policy module will override the production module
|
||
|
||
make -f %{_datadir}/selinux/devel/Makefile %{srcname}.pp
|
||
bzip2 -9 %{srcname}.pp
|
||
%endif
|
||
|
||
%build
|
||
%py3_build
|
||
|
||
mkdir -p manpages
|
||
rst2man --syntax-highlight=none docs/man/keylime_tenant.1.rst manpages/keylime_tenant.1
|
||
rst2man --syntax-highlight=none docs/man/keylime-policy.1.rst manpages/keylime-policy.1
|
||
rst2man --syntax-highlight=none docs/man/keylime_registrar.8.rst manpages/keylime_registrar.8
|
||
rst2man --syntax-highlight=none docs/man/keylime_verifier.8.rst manpages/keylime_verifier.8
|
||
|
||
%install
|
||
%py3_install
|
||
mkdir -p %{buildroot}/%{_sharedstatedir}/%{srcname}
|
||
mkdir -p --mode=0700 %{buildroot}/%{_rundir}/%{srcname}
|
||
|
||
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/
|
||
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||
install -Dpm 400 config/${comp}.conf %{buildroot}/%{_sysconfdir}/%{srcname}
|
||
done
|
||
|
||
# Do not ship a few scripts that are to be obsoleted soon.
|
||
# The functionality they provide is now provided by keylime-policy.
|
||
for s in keylime_convert_runtime_policy \
|
||
keylime_create_policy \
|
||
keylime_sign_runtime_policy; do
|
||
rm -f %{buildroot}/%{_bindir}/"${s}"
|
||
done
|
||
|
||
# Ship the ek-openssl-verify script.
|
||
mkdir -p %{buildroot}/%{_datadir}/%{srcname}/scripts
|
||
for s in ek-openssl-verify keylime_oneshot_attestation; do
|
||
install -Dpm 755 scripts/"${s}" \
|
||
%{buildroot}/%{_datadir}/%{srcname}/scripts/"${s}"
|
||
done
|
||
|
||
# Ship configuration templates.
|
||
cp -r ./templates %{buildroot}%{_datadir}/%{srcname}/templates/
|
||
|
||
mkdir -p --mode=0755 %{buildroot}/%{_bindir}
|
||
install -Dpm 755 ./keylime/cmd/convert_config.py %{buildroot}/%{_bindir}/keylime_upgrade_config
|
||
|
||
%if 0%{?with_selinux}
|
||
install -D -m 0644 %{srcname}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||
install -D -p -m 0644 keylime-selinux-%{policy_version}/%{srcname}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||
%endif
|
||
|
||
install -Dpm 644 ./services/%{srcname}_verifier.service \
|
||
%{buildroot}%{_unitdir}/%{srcname}_verifier.service
|
||
|
||
install -Dpm 644 ./services/%{srcname}_registrar.service \
|
||
%{buildroot}%{_unitdir}/%{srcname}_registrar.service
|
||
|
||
# TPM cert store is deployed to both /usr/share/keylime/tpm_cert_store
|
||
# and then /var/lib/keylime/tpm_cert_store.
|
||
for cert_store_dir in %{_datadir} %{_sharedstatedir}; do
|
||
mkdir -p %{buildroot}/"${cert_store_dir}"/%{srcname}
|
||
cp -r ./tpm_cert_store %{buildroot}/"${cert_store_dir}"/%{srcname}/
|
||
done
|
||
|
||
# Install the sysusers + tmpfiles.d configuration.
|
||
install -p -D -m 0644 %{SOURCE2} %{buildroot}/%{_sysusersdir}/%{srcname}.conf
|
||
install -p -D -m 0644 %{SOURCE3} %{buildroot}/%{_tmpfilesdir}/%{name}.conf
|
||
|
||
# Install manpages
|
||
install -d %{buildroot}%{_mandir}/man1
|
||
install -d %{buildroot}%{_mandir}/man8
|
||
install -m 644 manpages/keylime_tenant.1 %{buildroot}%{_mandir}/man1/
|
||
install -m 644 manpages/keylime-policy.1 %{buildroot}%{_mandir}/man1/
|
||
install -m 644 manpages/keylime_registrar.8 %{buildroot}%{_mandir}/man8/
|
||
install -m 644 manpages/keylime_verifier.8 %{buildroot}%{_mandir}/man8/
|
||
|
||
%check
|
||
# Create the default configuration files to be used by the tests.
|
||
# Also set the associated environment variables so that the tests
|
||
# will actually use them.
|
||
CONF_TEMP_DIR="$(mktemp -d)"
|
||
|
||
%{python3} -m keylime.cmd.convert_config --out "${CONF_TEMP_DIR}" --templates templates/
|
||
export KEYLIME_VERIFIER_CONFIG="${CONF_TEMP_DIR}/verifier.conf"
|
||
export KEYLIME_TENANT_CONFIG="${CONF_TEMP_DIR}/tenant.conf"
|
||
export KEYLIME_REGISTRAR_CONFIG="${CONF_TEMP_DIR}/registrar.conf"
|
||
export KEYLIME_CA_CONFIG="${CONF_TEMP_DIR}/ca.conf"
|
||
export KEYLIME_LOGGING_CONFIG="${CONF_TEMP_DIR}/logging.conf"
|
||
|
||
# Run the tests.
|
||
%pytest
|
||
|
||
# Cleanup.
|
||
[ "${CONF_TEMP_DIR}" ] && rm -rf "${CONF_TEMP_DIR}"
|
||
for e in KEYLIME_VERIFIER_CONFIG \
|
||
KEYLIME_TENANT_CONFIG \
|
||
KEYLIME_REGISTRAR_CONFIG \
|
||
KEYLIME_CA_CONFIG \
|
||
KEYLIME_LOGGING_CONFIG; do
|
||
unset "${e}"
|
||
done
|
||
exit 0
|
||
|
||
%pre base
|
||
%sysusers_create_compat %{SOURCE2}
|
||
exit 0
|
||
|
||
%post base
|
||
/usr/bin/keylime_upgrade_config --component ca --component logging >/dev/null
|
||
exit 0
|
||
|
||
%posttrans base
|
||
if [ -d %{_sysconfdir}/%{srcname} ]; then
|
||
chmod 500 %{_sysconfdir}/%{srcname}
|
||
chown -R %{srcname}:%{srcname} %{_sysconfdir}/%{srcname}
|
||
|
||
for comp in "verifier" "tenant" "registrar" "ca" "logging"; do
|
||
[ -d %{_sysconfdir}/%{srcname}/${comp}.conf.d ] && \
|
||
chmod 500 %{_sysconfdir}/%{srcname}/${comp}.conf.d
|
||
done
|
||
fi
|
||
|
||
[ -d %{_sharedstatedir}/%{srcname} ] && \
|
||
chown -R %{srcname} %{_sharedstatedir}/%{srcname}/
|
||
|
||
[ -d %{_sharedstatedir}/%{srcname}/tpm_cert_store ] && \
|
||
chmod 400 %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem && \
|
||
chmod 500 %{_sharedstatedir}/%{srcname}/tpm_cert_store/
|
||
|
||
%post verifier
|
||
/usr/bin/keylime_upgrade_config --component verifier >/dev/null
|
||
%systemd_post %{srcname}_verifier.service
|
||
|
||
%post registrar
|
||
/usr/bin/keylime_upgrade_config --component registrar >/dev/null
|
||
%systemd_post %{srcname}_registrar.service
|
||
|
||
%post tenant
|
||
/usr/bin/keylime_upgrade_config --component tenant >/dev/null
|
||
exit 0
|
||
|
||
%if 0%{?with_selinux}
|
||
# SELinux contexts are saved so that only affected files can be
|
||
# relabeled after the policy module installation
|
||
%pre selinux
|
||
%selinux_relabel_pre -s %{selinuxtype}
|
||
|
||
%post selinux
|
||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.bz2
|
||
%selinux_relabel_post -s %{selinuxtype}
|
||
|
||
if [ "$1" -le "1" ]; then # First install
|
||
# The services need to be restarted for the custom label to be
|
||
# applied in case they where already present in the system,
|
||
# restart fails silently in case they where not.
|
||
for svc in registrar verifier; do
|
||
[ -f "%{_unitdir}/%{srcname}_${svc}".service ] && \
|
||
%systemd_postun_with_restart "%{srcname}_${svc}".service
|
||
done
|
||
fi
|
||
exit 0
|
||
|
||
%postun selinux
|
||
if [ $1 -eq 0 ]; then
|
||
%selinux_modules_uninstall -s %{selinuxtype} %{srcname}
|
||
%selinux_relabel_post -s %{selinuxtype}
|
||
fi
|
||
%endif
|
||
|
||
%preun verifier
|
||
%systemd_preun %{srcname}_verifier.service
|
||
|
||
%preun registrar
|
||
%systemd_preun %{srcname}_registrar.service
|
||
|
||
%preun tenant
|
||
%systemd_preun %{srcname}_registrar.service
|
||
|
||
%postun verifier
|
||
%systemd_postun_with_restart %{srcname}_verifier.service
|
||
|
||
%postun registrar
|
||
%systemd_postun_with_restart %{srcname}_registrar.service
|
||
|
||
%files verifier
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/verifier.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/verifier.conf
|
||
%{_bindir}/%{srcname}_verifier
|
||
%{_bindir}/%{srcname}_ca
|
||
%{_unitdir}/keylime_verifier.service
|
||
%{_mandir}/man8/keylime_verifier.8*
|
||
|
||
%files registrar
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/registrar.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/registrar.conf
|
||
%{_bindir}/%{srcname}_registrar
|
||
%{_unitdir}/keylime_registrar.service
|
||
%{_mandir}/man8/keylime_registrar.8*
|
||
|
||
%if 0%{?with_selinux}
|
||
%files selinux
|
||
%{_datadir}/selinux/packages/%{selinuxtype}/%{srcname}.pp.*
|
||
%{_datadir}/selinux/devel/include/distributed/%{srcname}.if
|
||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{srcname}
|
||
%endif
|
||
|
||
%files tenant
|
||
%license LICENSE
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/tenant.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/tenant.conf
|
||
%{_bindir}/%{srcname}_tenant
|
||
%{_mandir}/man1/keylime_tenant.1*
|
||
|
||
%files -n python3-%{srcname}
|
||
%license LICENSE
|
||
%{python3_sitelib}/%{srcname}-*.egg-info/
|
||
%{python3_sitelib}/%{srcname}
|
||
%{_bindir}/keylime_attest
|
||
%{_bindir}/keylime-policy
|
||
%{_mandir}/man1/keylime-policy.1*
|
||
|
||
|
||
%files tools
|
||
%license LICENSE
|
||
%{_bindir}/%{srcname}_userdata_encrypt
|
||
|
||
%files base
|
||
%license LICENSE
|
||
%doc README.md
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sysconfdir}/%{srcname}/{ca,logging}.conf.d
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/ca.conf
|
||
%config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/logging.conf
|
||
%attr(700,%{srcname},%{srcname}) %dir %{_rundir}/%{srcname}
|
||
%attr(700,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}
|
||
%attr(755,root,root) %dir %{_datadir}/%{srcname}/tpm_cert_store
|
||
%attr(644,root,root) %{_datadir}/%{srcname}/tpm_cert_store/*.pem
|
||
%attr(500,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}/tpm_cert_store
|
||
%attr(400,%{srcname},%{srcname}) %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem
|
||
%{_tmpfilesdir}/%{srcname}.conf
|
||
%{_sysusersdir}/%{srcname}.conf
|
||
%{_datadir}/%{srcname}/scripts/ek-openssl-verify
|
||
%{_datadir}/%{srcname}/scripts/keylime_oneshot_attestation
|
||
%{_datadir}/%{srcname}/templates
|
||
%{_bindir}/keylime_upgrade_config
|
||
|
||
%files
|
||
%license LICENSE
|
||
|
||
%changelog
|
||
%autochangelog
|