71 lines
2.0 KiB
Diff
71 lines
2.0 KiB
Diff
From 396d3cc7ff39e54ce2de1fa9389348238b0ed92e Mon Sep 17 00:00:00 2001
|
|
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
|
|
Date: Mon, 27 Apr 2015 18:24:12 -0400
|
|
Subject: [PATCH] Extend evm-enable.sh to load the EVM public key
|
|
|
|
Create the _evm keyring and load the EVM public key on it.
|
|
---
|
|
modules.d/98integrity/evm-enable.sh | 42 +++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 42 insertions(+)
|
|
|
|
diff --git a/modules.d/98integrity/evm-enable.sh b/modules.d/98integrity/evm-enable.sh
|
|
index dee1c6c..ec4f03b 100755
|
|
--- a/modules.d/98integrity/evm-enable.sh
|
|
+++ b/modules.d/98integrity/evm-enable.sh
|
|
@@ -48,6 +48,45 @@ load_evm_key()
|
|
info "integrity: failed to load the EVM encrypted key: ${EVMKEYDESC}";
|
|
return 1;
|
|
}
|
|
+ return 0
|
|
+}
|
|
+
|
|
+load_evm_x509()
|
|
+{
|
|
+ info "Load EVM IMA X509"
|
|
+
|
|
+ # override the EVM key path name from the 'evmx509=' parameter in
|
|
+ # the kernel command line
|
|
+ EVMX509ARG=$(getarg evmx509=)
|
|
+ [ $? -eq 0 ] && \
|
|
+ EVMX509=${EVMX509ARG}
|
|
+
|
|
+ # set the default value
|
|
+ [ -z "${EVMX509}" ] && \
|
|
+ EVMX509="/etc/keys/x509_evm.der";
|
|
+
|
|
+ # set the EVM public key path name
|
|
+ EVMX509PATH="${NEWROOT}${EVMX509}"
|
|
+
|
|
+ # check for EVM public key's existence
|
|
+ if [ ! -f "${EVMX509PATH}" ]; then
|
|
+ if [ "${RD_DEBUG}" = "yes" ]; then
|
|
+ info "integrity: EVM x509 cert file not found: ${EVMX509PATH}"
|
|
+ fi
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+ # load the EVM public key onto the EVM keyring
|
|
+ evm_pubid=`keyctl newring _evm @u`
|
|
+ EVMX509ID=$(evmctl import ${EVMX509PATH} ${evm_pubid})
|
|
+ [ $? -eq 0 ] || {
|
|
+ info "integrity: failed to load the EVM X509 cert ${EVMX509PATH}";
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ if [ "${RD_DEBUG}" = "yes" ]; then
|
|
+ keyctl show @u
|
|
+ fi
|
|
|
|
return 0
|
|
}
|
|
@@ -76,6 +115,9 @@ enable_evm()
|
|
# load the EVM encrypted key
|
|
load_evm_key || return 1
|
|
|
|
+ # load the EVM public key, if it exists
|
|
+ load_evm_x509
|
|
+
|
|
# initialize EVM
|
|
info "Enabling EVM"
|
|
echo 1 > ${EVMSECFILE}
|