diff options
Diffstat (limited to 'meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils')
4 files changed, 39 insertions, 165 deletions
diff --git a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-Do-not-get-generation-using-ioctl-when-evm_portable-.patch b/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-Do-not-get-generation-using-ioctl-when-evm_portable-.patch new file mode 100644 index 0000000..f0d8975 --- /dev/null +++ b/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-Do-not-get-generation-using-ioctl-when-evm_portable-.patch @@ -0,0 +1,39 @@ +From 00ace817c5134d9844db387cadb9517ebad43808 Mon Sep 17 00:00:00 2001 +From: Stefan Berger <stefanb@linux.ibm.com> +Date: Tue, 18 Apr 2023 11:43:55 -0400 +Subject: [PATCH] Do not get generation using ioctl when evm_portable is true + +If a signatures is detected as being portable do not attempt to read the +generation with the ioctl since in some cases this may not be supported +by the filesystem and is also not needed for computing a portable +signature. + +This avoids the current work-around of passing --generation 0 when the +ioctl is not supported by the filesystem. + +Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> +--- +Upstream-Status: Pending + + src/evmctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/evmctl.c b/src/evmctl.c +index 6d2bb67..c35a28c 100644 +--- a/src/evmctl.c ++++ b/src/evmctl.c +@@ -376,7 +376,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) + if (mode_str) + st.st_mode = strtoul(mode_str, NULL, 10); + +- if (!evm_immutable) { ++ if (!evm_immutable && !evm_portable) { + if (S_ISREG(st.st_mode) && !generation_str) { + int fd = open(file, 0); + +--- +Upstream-Status: Pending + +2.39.2 + + diff --git a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch b/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch deleted file mode 100644 index 35c3162..0000000 --- a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 5834216fb3aa4e5e59ee13e871c70db1b4e13f02 Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Fri, 30 Sep 2016 10:22:16 +0200 -Subject: [PATCH] command line: apply operation to all paths - -Previously, invocations like "evmctl ima_hash foo bar" silently -ignored all parameters after the first path name ("foo" in this -example). - -Now evmctl iterates over all specified paths. It aborts with an -error as soon as the selected operation fails for a path. - -Supporting more than one parameter is useful in combination with -"find" and "xargs" because it is noticably faster than invoking -evmutil separately for each file, in particular when run under pseudo -(a fakeroot environment used by the OpenEmbedded build system). - -This complements the recursive mode and can be used when more control -over file selection is needed. - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> ---- - src/evmctl.c | 21 ++++++++++++--------- - 1 file changed, 12 insertions(+), 9 deletions(-) - -diff --git a/src/evmctl.c b/src/evmctl.c -index 23cf54c..2072034 100644 ---- a/src/evmctl.c -+++ b/src/evmctl.c -@@ -626,7 +626,7 @@ static int get_file_type(const char *path, const char *search_type) - static int do_cmd(struct command *cmd, find_cb_t func) - { - char *path = g_argv[optind++]; -- int err, dts = REG_MASK; /* only regular files by default */ -+ int err = 0, dts = REG_MASK; /* only regular files by default */ - - if (!path) { - log_err("Parameters missing\n"); -@@ -634,15 +634,18 @@ static int do_cmd(struct command *cmd, find_cb_t func) - return -1; - } - -- if (recursive) { -- if (search_type) { -- dts = get_file_type(path, search_type); -- if (dts < 0) -- return dts; -+ while (path && !err) { -+ if (recursive) { -+ if (search_type) { -+ dts = get_file_type(path, search_type); -+ if (dts < 0) -+ return dts; -+ } -+ err = find(path, dts, func); -+ } else { -+ err = func(path); - } -- err = find(path, dts, func); -- } else { -- err = func(path); -+ path = g_argv[optind++]; - } - - return err; --- -2.1.4 - diff --git a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch b/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch deleted file mode 100644 index 75076f5..0000000 --- a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 321a602098d11ee712ebd01f51033b5fd369eae9 Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Wed, 13 May 2015 03:41:02 -0700 -Subject: [PATCH] Makefile.am: disable man page creation - -Depends on asciidoc, which is not available. - -Upstream-Status: Inappropriate [embedded specific] - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> ---- - Makefile.am | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -diff --git a/Makefile.am b/Makefile.am -index 06ebf59..4ddd52c 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -1,5 +1,5 @@ - SUBDIRS = src --dist_man_MANS = evmctl.1 -+# dist_man_MANS = evmctl.1 - - doc_DATA = examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh - EXTRA_DIST = autogen.sh $(doc_DATA) -@@ -39,4 +39,21 @@ rmman: - - doc: evmctl.1.html rmman evmctl.1 - -+# requires asciidoc, xslproc, docbook-xsl -+# FIXME Disabled until docbook-xsl is unavaliable on tizen.org -+#MANPAGE_DOCBOOK_XSL = /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl -+# -+#evmctl.1.html: README -+# @asciidoc -o $@ $< -+# -+#evmctl.1: -+# asciidoc -d manpage -b docbook -o evmctl.1.xsl README -+# xsltproc --nonet -o $@ $(MANPAGE_DOCBOOK_XSL) evmctl.1.xsl -+# rm -f evmctl.1.xsl -+# -+#rmman: -+# rm -f evmctl.1 -+# -+#doc: evmctl.1.html rmman evmctl.1 -+ - .PHONY: $(tarname) --- -1.8.4.5 - diff --git a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch b/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch deleted file mode 100644 index ffa65df..0000000 --- a/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 2dec9199f8a8a2c84b25a3d3e7e2f41b71e07834 Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Wed, 17 Jun 2015 14:28:18 +0200 -Subject: [PATCH 20/20] evmctl.c: do not depend on xattr.h with IMA defines - -Compilation on older Linux distros (like Ubuntu 12.04) fails -because linux/xattr.h does not yet have the IMA defines. Compiling -there makes sense when only the tools are needed, for example when -signing an image in cross-compile mode. - -To support this, add fallbacks for the two defines which are needed. -Their value is part of the Linux ABI and thus fixed. - -Upstream-status: Submitted [linux-ima-devel@lists.sourceforge.net] - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> - ---- - src/evmctl.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/src/evmctl.c b/src/evmctl.c -index c54efbb..23cf54c 100644 ---- a/src/evmctl.c -+++ b/src/evmctl.c -@@ -57,6 +57,18 @@ - #include <termios.h> - #include <assert.h> - -+/* -+ * linux/xattr.h might be old to have this. Allow compilation on older -+ * Linux distros (like Ubuntu 12.04) by falling back to our own -+ * definition. -+ */ -+#ifndef XATTR_IMA_SUFFIX -+# define XATTR_IMA_SUFFIX "ima" -+#endif -+#ifndef XATTR_NAME_IMA -+# define XATTR_NAME_IMA XATTR_SECURITY_PREFIX XATTR_IMA_SUFFIX -+#endif -+ - #include <openssl/sha.h> - #include <openssl/pem.h> - #include <openssl/hmac.h> --- -2.1.4 - |