1# No default! Either this or IMA_EVM_PRIVKEY/IMA_EVM_X509 have to be 2# set explicitly in a local.conf before activating ima-evm-rootfs. 3# To use the insecure (because public) example keys, use 4# IMA_EVM_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys" 5IMA_EVM_KEY_DIR ?= "IMA_EVM_KEY_DIR_NOT_SET" 6 7# Private key for IMA signing. The default is okay when 8# using the example key directory. 9IMA_EVM_PRIVKEY ?= "${IMA_EVM_KEY_DIR}/privkey_ima.pem" 10 11# Public part of certificates (used for both IMA and EVM). 12# The default is okay when using the example key directory. 13IMA_EVM_X509 ?= "${IMA_EVM_KEY_DIR}/x509_ima.der" 14 15# Root CA to be compiled into the kernel, none by default. 16# Must be the absolute path to a der-encoded x509 CA certificate 17# with a .x509 suffix. See linux-%.bbappend for details. 18# 19# ima-local-ca.x509 is what ima-gen-local-ca.sh creates. 20IMA_EVM_ROOT_CA ?= "" 21 22# Sign all regular files by default. 23IMA_EVM_ROOTFS_SIGNED ?= ". -type f" 24# Hash nothing by default. 25IMA_EVM_ROOTFS_HASHED ?= ". -depth 0 -false" 26 27# Mount these file systems (identified via their mount point) with 28# the iversion flags (needed by IMA when allowing writing). 29IMA_EVM_ROOTFS_IVERSION ?= "" 30 31# Avoid re-generating fstab when ima is enabled. 32WIC_CREATE_EXTRA_ARGS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' --no-fstab-update', '', d)}" 33 34ima_evm_sign_rootfs () { 35 cd ${IMAGE_ROOTFS} 36 37 # Beware that all operations below must also work when 38 # ima_evm_sign_rootfs was already called earlier for the same 39 # rootfs. That's because do_image might again run for various 40 # reasons (including a change of the signing keys) without also 41 # re-running do_rootfs. 42 43 # Fix /etc/fstab: it must include the "i_version" mount option for 44 # those file systems where writing files is allowed, otherwise 45 # these changes will not get detected at runtime. 46 # 47 # Note that "i_version" is documented in "man mount" only for ext4, 48 # whereas "iversion" is said to be filesystem-independent. In practice, 49 # there is only one MS_I_VERSION flag in the syscall and ext2/ext3/ext4 50 # all support it. 51 # 52 # coreutils translates "iversion" into MS_I_VERSION. busybox rejects 53 # "iversion" and only understands "i_version". systemd only understands 54 # "iversion". We pick "iversion" here for systemd, whereas rootflags 55 # for initramfs must use "i_version" for busybox. 56 # 57 # Deduplicates iversion in case that this gets called more than once. 58 if [ -f etc/fstab ]; then 59 perl -pi -e 's;(\S+)(\s+)(${@"|".join((d.getVar("IMA_EVM_ROOTFS_IVERSION", True) or "no-such-mount-point").split())})(\s+)(\S+)(\s+)(\S+);\1\2\3\4\5\6\7,iversion;; s/(,iversion)+/,iversion/;' etc/fstab 60 fi 61 62 # Sign file with private IMA key. EVM not supported at the moment. 63 bbnote "IMA/EVM: signing files 'find ${IMA_EVM_ROOTFS_SIGNED}' with private key '${IMA_EVM_PRIVKEY}'" 64 find ${IMA_EVM_ROOTFS_SIGNED} | xargs -d "\n" --no-run-if-empty --verbose evmctl ima_sign --key ${IMA_EVM_PRIVKEY} 65 bbnote "IMA/EVM: hashing files 'find ${IMA_EVM_ROOTFS_HASHED}'" 66 find ${IMA_EVM_ROOTFS_HASHED} | xargs -d "\n" --no-run-if-empty --verbose evmctl ima_hash 67 68 # Optionally install custom policy for loading by systemd. 69 if [ "${IMA_EVM_POLICY_SYSTEMD}" ]; then 70 install -d ./${sysconfdir}/ima 71 rm -f ./${sysconfdir}/ima/ima-policy 72 install "${IMA_EVM_POLICY_SYSTEMD}" ./${sysconfdir}/ima/ima-policy 73 fi 74} 75 76# Signing must run as late as possible in the do_rootfs task. 77# To guarantee that, we append it to IMAGE_PREPROCESS_COMMAND in 78# RecipePreFinalise event handler, this ensures it's the last 79# function in IMAGE_PREPROCESS_COMMAND. 80python ima_evm_sign_handler () { 81 if not e.data or 'ima' not in e.data.getVar('DISTRO_FEATURES').split(): 82 return 83 84 e.data.appendVar('IMAGE_PREPROCESS_COMMAND', ' ima_evm_sign_rootfs; ') 85 e.data.appendVar('IMAGE_INSTALL', ' ima-evm-keys') 86 e.data.appendVarFlag('do_rootfs', 'depends', ' ima-evm-utils-native:do_populate_sysroot') 87} 88addhandler ima_evm_sign_handler 89ima_evm_sign_handler[eventmask] = "bb.event.RecipePreFinalise" 90