[yocto] [meta-security][PATCH 06/14] linux: update bbappend
Armin Kuster
akuster808 at gmail.com
Sun May 26 21:56:33 PDT 2019
remove untested code
Signed-off-by: Armin Kuster <akuster808 at gmail.com>
---
.../recipes-kernel/linux/linux-%.bbappend | 117 +-----------------
1 file changed, 2 insertions(+), 115 deletions(-)
diff --git a/meta-integrity/recipes-kernel/linux/linux-%.bbappend b/meta-integrity/recipes-kernel/linux/linux-%.bbappend
index 48560b1..931854e 100644
--- a/meta-integrity/recipes-kernel/linux/linux-%.bbappend
+++ b/meta-integrity/recipes-kernel/linux/linux-%.bbappend
@@ -1,116 +1,3 @@
-IMA_ENABLED_HERE := "${@'yes' if bb.data.inherits_class('kernel', d) and 'ima' in d.getVar('DISTRO_FEATURES', True).split() else 'no'}"
+FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
-IMA_FILESEXTRAPATHS_yes := "${THISDIR}/linux:"
-IMA_FILESEXTRAPATHS_no := ""
-FILESEXTRAPATHS_prepend := "${IMA_FILESEXTRAPATHS_${IMA_ENABLED_HERE}}"
-
-# These two patches are necessary to unpack archives with security.ima xattr
-# such that security.ima is taken from the archive. If the policy
-# allows hashing, unpatched kernels (at least up to 4.3) will replace
-# a signed hash in security.ima with a locally computed hash.
-#
-# Note that only bsdtar/libarchive are known to work; GNU tar sets
-# the security.ima on an empty file and the tries re-opening it for
-# writing its content, which then fails due to the IMA hash mismatch.
-#
-# Kernels >= 4.7 have the patches, while older kernels are likely to
-# need the patches. So apply them by default. To avoid that,
-# set IMA_EVM_SETATTR_PATCH_x.y.z (where x.y.z == linux kernel version)
-# to an empty string (to avoid patching) or some other patch files
-# suitable for that kernel.
-def ima_evm_setattr_patch(d):
- result = []
- linux_version = d.getVar('LINUX_VERSION', True) or ''
- # These two patches are known to be included upstream.
- if bb.utils.vercmp_string_op(linux_version, '4.7', '<'):
- patches = d.getVar('IMA_EVM_SETATTR_PATCH_' + linux_version, True)
- if patches != None:
- # Patches explicitly chosen, may be empty.
- result.append(patches)
- else:
- # Enabled by default.
- result.append('file://0001-ima-fix-ima_inode_post_setattr.patch file://0002-ima-add-support-for-creating-files-using-the-mknodat.patch')
- # This one addresses a problem added in 4.2. The upstream revert will land
- # in some future kernel. We need to extend version check once we know
- # which kernels have the patch.
- if bb.utils.vercmp_string_op(linux_version, '4.2', '>='):
- patches = d.getVar('IMA_EVM_SETATTR_REVERT_PATCH_' + linux_version, True)
- if patches != None:
- # Patches explicitly chosen, may be empty.
- result.append(patches)
- else:
- # Enabled by default.
- result.append('file://Revert-ima-limit-file-hash-setting-by-user-to-fix-an.patch')
- return ' '.join(result)
-
-# Edison kernel too old, patch not applicable -> swupd is broken in Ostro OS for Edison.
-IMA_EVM_SETATTR_PATCH_3.10.98 = ""
-
-# Kernel config fragment enabling IMA/EVM and (where necessary and possible)
-# also patching the kernel.
-IMA_EVM_CFG_yes = " file://ima.cfg \
- ${@ ima_evm_setattr_patch(d)} \
- "
-IMA_EVM_CFG_no = ""
-SRC_URI_append = "${IMA_EVM_CFG_${IMA_ENABLED_HERE}}"
-
-# IMA_EVM_ROOT_CA, if set, is the absolute path to a der-encoded
-# x509 CA certificate which will get compiled into the kernel.
-# The kernel will then use it to validate additional certificates,
-# like the one loaded dynamically for IMA.
-#
-# Depending on the kernel version, there are two ways to add the
-# CA certificate:
-# - For Linux < 4.3, we put the x509 file into the source directory
-# where the kernel compilation will find it automatically
-# (http://lxr.free-electrons.com/source/kernel/Makefile?v=4.2#L115).
-# - For Linux >= 4.3, we set SYSTEM_TRUSTED_KEYS
-# (http://lxr.free-electrons.com/source/certs/Kconfig?v=4.3#L29).
-# The ima_evm_root_ca.cfg only contains a blank file name.
-# The actual file name gets patched in after the file was used
-# to configure the kernel (see do_kernel_configme_append).
-# This has to point to a single file, i.e. using it for IMA has to
-# be coordinated with other usages.
-#
-# The IMA_EVM_ROOT_CA default is set globally in ima-evm-rootfs.bbclass.
-# Need weaker default here in case that ima-evm-rootfs.bbclass is not
-# inherited.
-IMA_EVM_ROOT_CA ??= ""
-
-# Add CONFIG_SYSTEM_TRUSTED_KEYS (for recent kernels) and
-# copy the root certificate into the build directory. By using
-# the normal fetcher mechanism for the certificate we ensure that
-# a rebuild is triggered when the file name or content change.
-#
-# Recompiling on name change is a bit too aggressive and causes
-# unnecessary rebuilds when only the location of the file, but not its
-# content change. This may need further work, should it become a problem
-# in practice. For example, IMA_EVM_ROOT_CA could be redefined as
-# an URL that then gets found via the normal file lookup.
-#
-# The fetcher does not expand SRC_URI. We have to enforce that here.
-IMA_EVM_ROOT_CA_CFG_yes = "${@ \
- ((' file://ima_evm_root_ca.cfg' if bb.utils.vercmp_string_op('${LINUX_VERSION}', '4.3', '>=') else '') + \
- ' file://${IMA_EVM_ROOT_CA}') \
- if '${IMA_EVM_ROOT_CA}' else ''}"
-IMA_EVM_ROOT_CA_CFG_no = ""
-
-SRC_URI_append = "${IMA_EVM_ROOT_CA_CFG_${IMA_ENABLED_HERE}}"
-
-do_kernel_configme_append () {
- if [ '${IMA_EVM_ROOT_CA}' ] && grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS=' ${B}/.config; then
- # We can replace a blank value from ima_evm_root_ca.cfg,
- # but when we find some other value, then we have to abort
- # because we can't set more than one value.
- eval `grep '^CONFIG_SYSTEM_TRUSTED_KEYS='`
- if [ "$CONFIG_SYSTEM_TRUSTED_KEYS" ] && [ "$CONFIG_SYSTEM_TRUSTED_KEYS" != "${IMA_EVM_ROOT_CA}" ]; then
- bbfatal "CONFIG_SYSTEM_TRUSTED_KEYS already set to $CONFIG_SYSTEM_TRUSTED_KEYS, cannot replace with IMA_EVM_ROOT_CA = ${IMA_EVM_ROOT_CA}"
- exit 1
- fi
- pemcert=${B}/`basename ${IMA_EVM_ROOT_CA}`.pem
- openssl x509 -inform der -in ${IMA_EVM_ROOT_CA} -out $pemcert
- sed -i -e "s;^CONFIG_SYSTEM_TRUSTED_KEYS=.*;CONFIG_SYSTEM_TRUSTED_KEYS=\"$pemcert\";" ${B}/.config
- fi
-}
-
-do_kernel_configme[depends] += "${@ 'openssl-native:do_populate_sysroot' if '${IMA_ENABLED_HERE}' == 'yes' and '${IMA_EVM_ROOT_CA}' else '' }"
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' file://ima.cfg', '', d)}"
--
2.17.1
More information about the yocto
mailing list