Blame 0056-Define-new-script-to-load-keys-on-the-IMA-keyring-up.patch

Harald Hoyer 368a0c
From 41ac16b26fe05c8291d3467b8a7bee1bc2445393 Mon Sep 17 00:00:00 2001
Harald Hoyer 368a0c
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
Harald Hoyer 368a0c
Date: Wed, 29 Apr 2015 11:05:25 -0400
Harald Hoyer 368a0c
Subject: [PATCH] Define new script to load keys on the IMA keyring (update)
Harald Hoyer 368a0c
Harald Hoyer 368a0c
This patch supports loading keys either on the _ima keyring or, as of
Harald Hoyer 368a0c
Linux 3.17, on the trusted .ima keyring.  Only certificates signed by
Harald Hoyer 368a0c
a key on the system keyring can be loaded onto the trusted .ima keyring.
Harald Hoyer 368a0c
Harald Hoyer 368a0c
Changelog:
Harald Hoyer 368a0c
- Update 98integrity/README
Harald Hoyer 368a0c
---
Harald Hoyer 368a0c
 modules.d/98integrity/README           | 28 +++++++++++++++
Harald Hoyer 368a0c
 modules.d/98integrity/ima-keys-load.sh | 62 ++++++++++++++++++++++++++++++++++
Harald Hoyer 368a0c
 modules.d/98integrity/module-setup.sh  |  2 ++
Harald Hoyer 368a0c
 3 files changed, 92 insertions(+)
Harald Hoyer 368a0c
 create mode 100755 modules.d/98integrity/ima-keys-load.sh
Harald Hoyer 368a0c
Harald Hoyer 368a0c
diff --git a/modules.d/98integrity/README b/modules.d/98integrity/README
Harald Hoyer 368a0c
index d74e063..64de0ae 100644
Harald Hoyer 368a0c
--- a/modules.d/98integrity/README
Harald Hoyer 368a0c
+++ b/modules.d/98integrity/README
Harald Hoyer 368a0c
@@ -38,3 +38,31 @@ line.
Harald Hoyer 368a0c
 ------------- '/etc/sysconfig/ima' (with the default value) -------------
Harald Hoyer 368a0c
 IMAPOLICY="/etc/sysconfig/ima-policy"
Harald Hoyer 368a0c
 -------------------------------------------------------------------------
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# Information on loading distro, third party or local keys on the trusted IMA keyring
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# Loading distro, third party or local keys on the trusted IMA keyring requires
Harald Hoyer 368a0c
+# creating a local certificate authority(local-CA), installing the local-CA's
Harald Hoyer 368a0c
+# public key on the system-keyring and signing the certificates with the local-CA
Harald Hoyer 368a0c
+# key.
Harald Hoyer 368a0c
+#
Harald Hoyer 368a0c
+# Many directions for creating a mini certificate authority exist on the web
Harald Hoyer 368a0c
+# (eg. openssl, yubikey). (Reminder: safely storing the private key offline is
Harald Hoyer 368a0c
+# really important, especially in the case of the local-CA's private key.) The
Harald Hoyer 368a0c
+# local-CA's public key can be loaded onto the system keyring either by building
Harald Hoyer 368a0c
+# the key into the kernel or, on Fedora, storing it in the UEFI/Mok keyring. (As
Harald Hoyer 368a0c
+# of writing, the patches for loading the UEFI/Mok keys on the system-keyring
Harald Hoyer 368a0c
+# have not been upstreamed.)
Harald Hoyer 368a0c
+#
Harald Hoyer 368a0c
+# To view the system keyring: keyctl show %keyring:.system_keyring
Harald Hoyer 368a0c
+#
Harald Hoyer 368a0c
+# Most on-line directions for signing certificates requires creating a Certificate
Harald Hoyer 368a0c
+# Signing Request (CSR).  Creating such a request requires access to the private
Harald Hoyer 368a0c
+# key, which would not be available when signing distro or 3rd party certificates.
Harald Hoyer 368a0c
+# Openssl provides the "-ss_cert" option for directly signing certificates.
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# 98integrity/ima-keys-load.sh script loads the signed certificates stored 
Harald Hoyer 368a0c
+# in the $IMAKEYSDIR onto the trusted IMA keyring.  The default $IMAKEYSDIR
Harald Hoyer 368a0c
+# directory is /etc/keys/ima, but can be specified in the /etc/sysconfig/ima
Harald Hoyer 368a0c
+# policy.
Harald Hoyer 368a0c
diff --git a/modules.d/98integrity/ima-keys-load.sh b/modules.d/98integrity/ima-keys-load.sh
Harald Hoyer 368a0c
new file mode 100755
Harald Hoyer 368a0c
index 0000000..659b722
Harald Hoyer 368a0c
--- /dev/null
Harald Hoyer 368a0c
+++ b/modules.d/98integrity/ima-keys-load.sh
Harald Hoyer 368a0c
@@ -0,0 +1,62 @@
Harald Hoyer 368a0c
+#!/bin/sh
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+SECURITYFSDIR="/sys/kernel/security"
Harald Hoyer 368a0c
+IMASECDIR="${SECURITYFSDIR}/ima"
Harald Hoyer 368a0c
+IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+load_x509_keys()
Harald Hoyer 368a0c
+{
Harald Hoyer 368a0c
+    KEYRING_ID=$1
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+    # override the default configuration
Harald Hoyer 368a0c
+    if [ -f "${IMACONFIG}" ]; then
Harald Hoyer 368a0c
+        . ${IMACONFIG}
Harald Hoyer 368a0c
+    fi
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+    if [ -z "${IMAKEYDIR}" ]; then
Harald Hoyer 368a0c
+        IMAKEYSDIR="/etc/keys/ima"
Harald Hoyer 368a0c
+    fi
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+    PUBKEY_LIST=`ls ${NEWROOT}${IMAKEYSDIR}/*`
Harald Hoyer 368a0c
+    for PUBKEY in ${PUBKEY_LIST}; do
Harald Hoyer 368a0c
+        # check for public key's existence
Harald Hoyer 368a0c
+        if [ ! -f "${PUBKEY}" ]; then
Harald Hoyer 368a0c
+            if [ "${RD_DEBUG}" = "yes" ]; then
Harald Hoyer 368a0c
+                info "integrity: IMA x509 cert file not found: ${PUBKEY}"
Harald Hoyer 368a0c
+            fi
Harald Hoyer 368a0c
+            continue
Harald Hoyer 368a0c
+        fi
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+        X509ID=$(evmctl import ${PUBKEY} ${KEYRING_ID})
Harald Hoyer 368a0c
+        if [ $? -ne 0 ]; then
Harald Hoyer 368a0c
+            info "integrity: IMA x509 cert not loaded on keyring: ${PUBKEY}"
Harald Hoyer 368a0c
+        fi 
Harald Hoyer 368a0c
+    done
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+    if [ "${RD_DEBUG}" = "yes" ]; then
Harald Hoyer 368a0c
+        keyctl show  ${KEYRING_ID}
Harald Hoyer 368a0c
+    fi
Harald Hoyer 368a0c
+    return 0
Harald Hoyer 368a0c
+}
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# check kernel support for IMA
Harald Hoyer 368a0c
+if [ ! -e "${IMASECDIR}" ]; then
Harald Hoyer 368a0c
+    if [ "${RD_DEBUG}" = "yes" ]; then
Harald Hoyer 368a0c
+        info "integrity: IMA kernel support is disabled"
Harald Hoyer 368a0c
+    fi
Harald Hoyer 368a0c
+    return 0
Harald Hoyer 368a0c
+fi
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# get the IMA keyring id
Harald Hoyer 368a0c
+line=$(keyctl describe %keyring:.ima)
Harald Hoyer 368a0c
+if [ $? -eq 0 ]; then
Harald Hoyer 368a0c
+    _ima_id=${line%%:*}
Harald Hoyer 368a0c
+else
Harald Hoyer 368a0c
+    _ima_id=`keyctl search @u keyring _ima`
Harald Hoyer 368a0c
+    if [ -z "${_ima_id}" ]; then
Harald Hoyer 368a0c
+        _ima_id=`keyctl newring _ima @u`
Harald Hoyer 368a0c
+    fi
Harald Hoyer 368a0c
+fi
Harald Hoyer 368a0c
+
Harald Hoyer 368a0c
+# load the IMA public key(s)
Harald Hoyer 368a0c
+load_x509_keys ${_ima_id}
Harald Hoyer 368a0c
diff --git a/modules.d/98integrity/module-setup.sh b/modules.d/98integrity/module-setup.sh
Harald Hoyer 368a0c
index 2d4d2ed..34b33cd 100755
Harald Hoyer 368a0c
--- a/modules.d/98integrity/module-setup.sh
Harald Hoyer 368a0c
+++ b/modules.d/98integrity/module-setup.sh
Harald Hoyer 368a0c
@@ -13,6 +13,8 @@ depends() {
Harald Hoyer 368a0c
 
Harald Hoyer 368a0c
 # called by dracut
Harald Hoyer 368a0c
 install() {
Harald Hoyer 368a0c
+    dracut_install evmctl keyctl ls
Harald Hoyer 368a0c
     inst_hook pre-pivot 61 "$moddir/evm-enable.sh"
Harald Hoyer 368a0c
+    inst_hook pre-pivot 61 "$moddir/ima-keys-load.sh"
Harald Hoyer 368a0c
     inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
Harald Hoyer 368a0c
 }