This patch supports loading keys either on the _ima keyring or, as of
Linux 3.17, on the trusted .ima keyring. Only certificates signed by
a key on the system keyring can be loaded onto the trusted .ima keyring.
---
modules.d/98integrity/ima-keys-load.sh | 62 ++++++++++++++++++++++++++++++++++
modules.d/98integrity/module-setup.sh | 2 ++
2 files changed, 64 insertions(+)
create mode 100755 modules.d/98integrity/ima-keys-load.sh
diff --git a/modules.d/98integrity/ima-keys-load.sh
b/modules.d/98integrity/ima-keys-load.sh
new file mode 100755
index 0000000..659b722
--- /dev/null
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+SECURITYFSDIR="/sys/kernel/security"
+IMASECDIR="${SECURITYFSDIR}/ima"
+IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+
+load_x509_keys()
+{
+ KEYRING_ID=$1
+
+ # override the default configuration
+ if [ -f "${IMACONFIG}" ]; then
+ . ${IMACONFIG}
+ fi
+
+ if [ -z "${IMAKEYDIR}" ]; then
+ IMAKEYSDIR="/etc/keys/ima"
+ fi
+
+ PUBKEY_LIST=`ls ${NEWROOT}${IMAKEYSDIR}/*`
+ for PUBKEY in ${PUBKEY_LIST}; do
+ # check for public key's existence
+ if [ ! -f "${PUBKEY}" ]; then
+ if [ "${RD_DEBUG}" = "yes" ]; then
+ info "integrity: IMA x509 cert file not found: ${PUBKEY}"
+ fi
+ continue
+ fi
+
+ X509ID=$(evmctl import ${PUBKEY} ${KEYRING_ID})
+ if [ $? -ne 0 ]; then
+ info "integrity: IMA x509 cert not loaded on keyring: ${PUBKEY}"
+ fi
+ done
+
+ if [ "${RD_DEBUG}" = "yes" ]; then
+ keyctl show ${KEYRING_ID}
+ fi
+ return 0
+}
+
+# check kernel support for IMA
+if [ ! -e "${IMASECDIR}" ]; then
+ if [ "${RD_DEBUG}" = "yes" ]; then
+ info "integrity: IMA kernel support is disabled"
+ fi
+ return 0
+fi
+
+# get the IMA keyring id
+line=$(keyctl describe %keyring:.ima)
+if [ $? -eq 0 ]; then
+ _ima_id=${line%%:*}
+else
+ _ima_id=`keyctl search @u keyring _ima`
+ if [ -z "${_ima_id}" ]; then
+ _ima_id=`keyctl newring _ima @u`
+ fi
+fi
+
+# load the IMA public key(s)
+load_x509_keys ${_ima_id}
diff --git a/modules.d/98integrity/module-setup.sh
b/modules.d/98integrity/module-setup.sh
index 2d4d2ed..34b33cd 100755
--- a/modules.d/98integrity/module-setup.sh
+++ b/modules.d/98integrity/module-setup.sh
@@ -13,6 +13,8 @@ depends() {
# called by dracut
install() {
+ dracut_install evmctl keyctl ls
inst_hook pre-pivot 61 "$moddir/evm-enable.sh"
+ inst_hook pre-pivot 61 "$moddir/ima-keys-load.sh"
inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
}
--
2.1.0
--
To unsubscribe from this list: send the line "unsubscribe initramfs" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
