From: Armin Kuster <akuster808@gmail.com>
To: yocto@yoctoproject.org
Subject: [meta-security][PATCH 00/14] Port over meta-integrity
Date: Sun, 26 May 2019 21:56:27 -0700 [thread overview]
Message-ID: <20190527045641.18884-1-akuster808@gmail.com> (raw)
Copied meta-integrity from meta-intel-iot-security that Intel created,
to carry on maintenance.
This update that code base to work on master.
runtime test passes on Arm H/w and qemux86-64
Armin Kuster (14):
meta-integrity: port over from meta-intel-iot-security
layer.conf: add LAYERSERIES_COMPAT
README: update
ima-evm-utils: cleanup and update to tip
ima.cfg: update to 5.0 kernel
linux: update bbappend
base-files: add appending to automount securityfs
ima-policy-hashed: add new recipe
ima_policy_simple: add another sample policy
policy: add ima appraise all policy
data: remove policies
initramfs: clean up to pull in packages.
runtime qa: moderize ima test
image: add image for testing
meta-integrity/README.md | 250 ++++++++++++++++++
meta-integrity/classes/ima-evm-rootfs.bbclass | 92 +++++++
meta-integrity/conf/layer.conf | 24 ++
.../data/debug-keys/privkey_ima.pem | 16 ++
meta-integrity/data/debug-keys/x509_ima.der | Bin 0 -> 707 bytes
meta-integrity/lib/oeqa/runtime/cases/ima.py | 129 +++++++++
.../base-files/base-files-ima.inc | 5 +
.../base-files/base-files_%.bbappend | 1 +
.../images/integrity-image-minimal.bb | 22 ++
.../initrdscripts/initramfs-framework-ima.bb | 28 ++
.../initrdscripts/initramfs-framework-ima/ima | 52 ++++
.../packagegroup-ima-evm-utils.bb | 9 +
.../systemd/files/machine-id-commit-sync.conf | 2 +
.../systemd/files/random-seed-sync.conf | 3 +
.../recipes-core/systemd/systemd_%.bbappend | 13 +
.../recipes-kernel/linux/linux-%.bbappend | 3 +
.../0001-ima-fix-ima_inode_post_setattr.patch | 51 ++++
...for-creating-files-using-the-mknodat.patch | 138 ++++++++++
...-file-hash-setting-by-user-to-fix-an.patch | 60 +++++
.../recipes-kernel/linux/linux/ima.cfg | 18 ++
.../linux/linux/ima_evm_root_ca.cfg | 3 +
...link-to-libcrypto-instead-of-OpenSSL.patch | 65 +++++
...ls-replace-INCLUDES-with-AM_CPPFLAGS.patch | 43 +++
...clude-hash-info.gen-into-distributio.patch | 31 +++
...ma-evm-utils-update-.gitignore-files.patch | 34 +++
...nd-line-apply-operation-to-all-paths.patch | 68 +++++
.../ima-evm-utils/disable-doc-creation.patch | 50 ++++
...t-depend-on-xattr.h-with-IMA-defines.patch | 47 ++++
.../ima-evm-utils/ima-evm-utils_git.bb | 41 +++
.../files/ima_policy_appraise_all | 29 ++
.../ima-policy-appraise-all_1.0.bb | 18 ++
.../ima_policy_hashed/files/ima_policy_hashed | 77 ++++++
.../ima-policy-hashed_1.0.bb | 20 ++
.../ima_policy_simple/files/ima_policy_simple | 4 +
.../ima-policy-simple_1.0.bb | 18 ++
meta-integrity/scripts/ima-gen-CA-signed.sh | 48 ++++
meta-integrity/scripts/ima-gen-local-ca.sh | 42 +++
meta-integrity/scripts/ima-gen-self-signed.sh | 41 +++
38 files changed, 1595 insertions(+)
create mode 100644 meta-integrity/README.md
create mode 100644 meta-integrity/classes/ima-evm-rootfs.bbclass
create mode 100644 meta-integrity/conf/layer.conf
create mode 100644 meta-integrity/data/debug-keys/privkey_ima.pem
create mode 100644 meta-integrity/data/debug-keys/x509_ima.der
create mode 100644 meta-integrity/lib/oeqa/runtime/cases/ima.py
create mode 100644 meta-integrity/recipes-core/base-files/base-files-ima.inc
create mode 100644 meta-integrity/recipes-core/base-files/base-files_%.bbappend
create mode 100644 meta-integrity/recipes-core/images/integrity-image-minimal.bb
create mode 100644 meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
create mode 100644 meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima/ima
create mode 100644 meta-integrity/recipes-core/packagegroups/packagegroup-ima-evm-utils.bb
create mode 100644 meta-integrity/recipes-core/systemd/files/machine-id-commit-sync.conf
create mode 100644 meta-integrity/recipes-core/systemd/files/random-seed-sync.conf
create mode 100644 meta-integrity/recipes-core/systemd/systemd_%.bbappend
create mode 100644 meta-integrity/recipes-kernel/linux/linux-%.bbappend
create mode 100644 meta-integrity/recipes-kernel/linux/linux/0001-ima-fix-ima_inode_post_setattr.patch
create mode 100644 meta-integrity/recipes-kernel/linux/linux/0002-ima-add-support-for-creating-files-using-the-mknodat.patch
create mode 100644 meta-integrity/recipes-kernel/linux/linux/Revert-ima-limit-file-hash-setting-by-user-to-fix-an.patch
create mode 100644 meta-integrity/recipes-kernel/linux/linux/ima.cfg
create mode 100644 meta-integrity/recipes-kernel/linux/linux/ima_evm_root_ca.cfg
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-ima-evm-utils-link-to-libcrypto-instead-of-OpenSSL.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0002-ima-evm-utils-replace-INCLUDES-with-AM_CPPFLAGS.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0003-ima-evm-utils-include-hash-info.gen-into-distributio.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0004-ima-evm-utils-update-.gitignore-files.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
create mode 100644 meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
create mode 100644 meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_appraise_all
create mode 100644 meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
create mode 100644 meta-integrity/recipes-security/ima_policy_hashed/files/ima_policy_hashed
create mode 100644 meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb
create mode 100644 meta-integrity/recipes-security/ima_policy_simple/files/ima_policy_simple
create mode 100644 meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
create mode 100755 meta-integrity/scripts/ima-gen-CA-signed.sh
create mode 100755 meta-integrity/scripts/ima-gen-local-ca.sh
create mode 100755 meta-integrity/scripts/ima-gen-self-signed.sh
--
2.17.1
next reply other threads:[~2019-05-27 4:56 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-27 4:56 Armin Kuster [this message]
2019-05-27 4:56 ` [meta-security][PATCH 01/14] meta-integrity: port over from meta-intel-iot-security Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 02/14] layer.conf: add LAYERSERIES_COMPAT Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 03/14] README: update Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 04/14] ima-evm-utils: cleanup and update to tip Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 05/14] ima.cfg: update to 5.0 kernel Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 06/14] linux: update bbappend Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 07/14] base-files: add appending to automount securityfs Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 08/14] ima-policy-hashed: add new recipe Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 09/14] ima_policy_simple: add another sample policy Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 10/14] policy: add ima appraise all policy Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 11/14] data: remove policies Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 12/14] initramfs: clean up to pull in packages Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 13/14] runtime qa: moderize ima test Armin Kuster
2019-05-27 4:56 ` [meta-security][PATCH 14/14] image: add image for testing Armin Kuster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190527045641.18884-1-akuster808@gmail.com \
--to=akuster808@gmail.com \
--cc=yocto@yoctoproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.