Define new script to load keys on the IMA keyring (update)
This patch supports loading keys either on the _ima keyring or, as of Linux 3.17, on the trusted .ima keyring. Only certificates signed by a key on the system keyring can be loaded onto the trusted .ima keyring. Changelog: - Update 98integrity/READMEmaster
parent
396d3cc7ff
commit
41ac16b26f
|
@ -38,3 +38,31 @@ line.
|
|||
------------- '/etc/sysconfig/ima' (with the default value) -------------
|
||||
IMAPOLICY="/etc/sysconfig/ima-policy"
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
|
||||
# Information on loading distro, third party or local keys on the trusted IMA keyring
|
||||
|
||||
# Loading distro, third party or local keys on the trusted IMA keyring requires
|
||||
# creating a local certificate authority(local-CA), installing the local-CA's
|
||||
# public key on the system-keyring and signing the certificates with the local-CA
|
||||
# key.
|
||||
#
|
||||
# Many directions for creating a mini certificate authority exist on the web
|
||||
# (eg. openssl, yubikey). (Reminder: safely storing the private key offline is
|
||||
# really important, especially in the case of the local-CA's private key.) The
|
||||
# local-CA's public key can be loaded onto the system keyring either by building
|
||||
# the key into the kernel or, on Fedora, storing it in the UEFI/Mok keyring. (As
|
||||
# of writing, the patches for loading the UEFI/Mok keys on the system-keyring
|
||||
# have not been upstreamed.)
|
||||
#
|
||||
# To view the system keyring: keyctl show %keyring:.system_keyring
|
||||
#
|
||||
# Most on-line directions for signing certificates requires creating a Certificate
|
||||
# Signing Request (CSR). Creating such a request requires access to the private
|
||||
# key, which would not be available when signing distro or 3rd party certificates.
|
||||
# Openssl provides the "-ss_cert" option for directly signing certificates.
|
||||
|
||||
# 98integrity/ima-keys-load.sh script loads the signed certificates stored
|
||||
# in the $IMAKEYSDIR onto the trusted IMA keyring. The default $IMAKEYSDIR
|
||||
# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
|
||||
# policy.
|
||||
|
|
|
@ -0,0 +1,62 @@
|
|||
#!/bin/sh
|
||||
|
||||
SECURITYFSDIR="/sys/kernel/security"
|
||||
IMASECDIR="${SECURITYFSDIR}/ima"
|
||||
IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
|
||||
|
||||
load_x509_keys()
|
||||
{
|
||||
KEYRING_ID=$1
|
||||
|
||||
# override the default configuration
|
||||
if [ -f "${IMACONFIG}" ]; then
|
||||
. ${IMACONFIG}
|
||||
fi
|
||||
|
||||
if [ -z "${IMAKEYDIR}" ]; then
|
||||
IMAKEYSDIR="/etc/keys/ima"
|
||||
fi
|
||||
|
||||
PUBKEY_LIST=`ls ${NEWROOT}${IMAKEYSDIR}/*`
|
||||
for PUBKEY in ${PUBKEY_LIST}; do
|
||||
# check for public key's existence
|
||||
if [ ! -f "${PUBKEY}" ]; then
|
||||
if [ "${RD_DEBUG}" = "yes" ]; then
|
||||
info "integrity: IMA x509 cert file not found: ${PUBKEY}"
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
X509ID=$(evmctl import ${PUBKEY} ${KEYRING_ID})
|
||||
if [ $? -ne 0 ]; then
|
||||
info "integrity: IMA x509 cert not loaded on keyring: ${PUBKEY}"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "${RD_DEBUG}" = "yes" ]; then
|
||||
keyctl show ${KEYRING_ID}
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# check kernel support for IMA
|
||||
if [ ! -e "${IMASECDIR}" ]; then
|
||||
if [ "${RD_DEBUG}" = "yes" ]; then
|
||||
info "integrity: IMA kernel support is disabled"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
# get the IMA keyring id
|
||||
line=$(keyctl describe %keyring:.ima)
|
||||
if [ $? -eq 0 ]; then
|
||||
_ima_id=${line%%:*}
|
||||
else
|
||||
_ima_id=`keyctl search @u keyring _ima`
|
||||
if [ -z "${_ima_id}" ]; then
|
||||
_ima_id=`keyctl newring _ima @u`
|
||||
fi
|
||||
fi
|
||||
|
||||
# load the IMA public key(s)
|
||||
load_x509_keys ${_ima_id}
|
|
@ -13,6 +13,8 @@ depends() {
|
|||
|
||||
# called by dracut
|
||||
install() {
|
||||
dracut_install evmctl keyctl ls
|
||||
inst_hook pre-pivot 61 "$moddir/evm-enable.sh"
|
||||
inst_hook pre-pivot 61 "$moddir/ima-keys-load.sh"
|
||||
inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue