dracut/0057-Extend-evm-enable.sh-to-load-the-EVM-public-key.patch

71 lines
2.0 KiB
Diff
Raw Normal View History

From 396d3cc7ff39e54ce2de1fa9389348238b0ed92e Mon Sep 17 00:00:00 2001
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
Date: Mon, 27 Apr 2015 18:24:12 -0400
Subject: [PATCH] Extend evm-enable.sh to load the EVM public key
Create the _evm keyring and load the EVM public key on it.
---
modules.d/98integrity/evm-enable.sh | 42 +++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/modules.d/98integrity/evm-enable.sh b/modules.d/98integrity/evm-enable.sh
index dee1c6c..ec4f03b 100755
--- a/modules.d/98integrity/evm-enable.sh
+++ b/modules.d/98integrity/evm-enable.sh
@@ -48,6 +48,45 @@ load_evm_key()
info "integrity: failed to load the EVM encrypted key: ${EVMKEYDESC}";
return 1;
}
+ return 0
+}
+
+load_evm_x509()
+{
+ info "Load EVM IMA X509"
+
+ # override the EVM key path name from the 'evmx509=' parameter in
+ # the kernel command line
+ EVMX509ARG=$(getarg evmx509=)
+ [ $? -eq 0 ] && \
+ EVMX509=${EVMX509ARG}
+
+ # set the default value
+ [ -z "${EVMX509}" ] && \
+ EVMX509="/etc/keys/x509_evm.der";
+
+ # set the EVM public key path name
+ EVMX509PATH="${NEWROOT}${EVMX509}"
+
+ # check for EVM public key's existence
+ if [ ! -f "${EVMX509PATH}" ]; then
+ if [ "${RD_DEBUG}" = "yes" ]; then
+ info "integrity: EVM x509 cert file not found: ${EVMX509PATH}"
+ fi
+ return 1
+ fi
+
+ # load the EVM public key onto the EVM keyring
+ evm_pubid=`keyctl newring _evm @u`
+ EVMX509ID=$(evmctl import ${EVMX509PATH} ${evm_pubid})
+ [ $? -eq 0 ] || {
+ info "integrity: failed to load the EVM X509 cert ${EVMX509PATH}";
+ return 1;
+ }
+
+ if [ "${RD_DEBUG}" = "yes" ]; then
+ keyctl show @u
+ fi
return 0
}
@@ -76,6 +115,9 @@ enable_evm()
# load the EVM encrypted key
load_evm_key || return 1
+ # load the EVM public key, if it exists
+ load_evm_x509
+
# initialize EVM
info "Enabling EVM"
echo 1 > ${EVMSECFILE}