[meta-security][PATCH 06/14] linux: update bbappend

[Armin Kuster <akuster808@gmail.com>]

remove untested code

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 .../recipes-kernel/linux/linux-%.bbappend     | 117 +-----------------
 1 file changed, 2 insertions(+), 115 deletions(-)

diff --git a/meta-integrity/recipes-kernel/linux/linux-%.bbappend b/meta-integrity/recipes-kernel/linux/linux-%.bbappend
index 48560b1..931854e 100644
--- a/meta-integrity/recipes-kernel/linux/linux-%.bbappend
+++ b/meta-integrity/recipes-kernel/linux/linux-%.bbappend
@@ -1,116 +1,3 @@
-IMA_ENABLED_HERE := "${@'yes' if bb.data.inherits_class('kernel', d) and 'ima' in d.getVar('DISTRO_FEATURES', True).split() else 'no'}"
+FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
 
-IMA_FILESEXTRAPATHS_yes := "${THISDIR}/linux:"
-IMA_FILESEXTRAPATHS_no := ""
-FILESEXTRAPATHS_prepend := "${IMA_FILESEXTRAPATHS_${IMA_ENABLED_HERE}}"
-
-# These two patches are necessary to unpack archives with security.ima xattr
-# such that security.ima is taken from the archive. If the policy
-# allows hashing, unpatched kernels (at least up to 4.3) will replace
-# a signed hash in security.ima with a locally computed hash.
-#
-# Note that only bsdtar/libarchive are known to work; GNU tar sets
-# the security.ima on an empty file and the tries re-opening it for
-# writing its content, which then fails due to the IMA hash mismatch.
-#
-# Kernels >= 4.7 have the patches, while older kernels are likely to
-# need the patches. So apply them by default. To avoid that,
-# set IMA_EVM_SETATTR_PATCH_x.y.z (where x.y.z == linux kernel version)
-# to an empty string (to avoid patching) or some other patch files
-# suitable for that kernel.
-def ima_evm_setattr_patch(d):
-    result = []
-    linux_version = d.getVar('LINUX_VERSION', True) or ''
-    # These two patches are known to be included upstream.
-    if bb.utils.vercmp_string_op(linux_version, '4.7', '<'):
-        patches = d.getVar('IMA_EVM_SETATTR_PATCH_' + linux_version, True)
-        if patches != None:
-            # Patches explicitly chosen, may be empty.
-            result.append(patches)
-        else:
-            # Enabled by default.
-            result.append('file://0001-ima-fix-ima_inode_post_setattr.patch file://0002-ima-add-support-for-creating-files-using-the-mknodat.patch')
-    # This one addresses a problem added in 4.2. The upstream revert will land
-    # in some future kernel. We need to extend version check once we know
-    # which kernels have the patch.
-    if bb.utils.vercmp_string_op(linux_version, '4.2', '>='):
-        patches = d.getVar('IMA_EVM_SETATTR_REVERT_PATCH_' + linux_version, True)
-        if patches != None:
-            # Patches explicitly chosen, may be empty.
-            result.append(patches)
-        else:
-            # Enabled by default.
-            result.append('file://Revert-ima-limit-file-hash-setting-by-user-to-fix-an.patch')
-    return ' '.join(result)
-
-# Edison kernel too old, patch not applicable -> swupd is broken in Ostro OS for Edison.
-IMA_EVM_SETATTR_PATCH_3.10.98 = ""
-
-# Kernel config fragment enabling IMA/EVM and (where necessary and possible)
-# also patching the kernel.
-IMA_EVM_CFG_yes = " file://ima.cfg \
-                    ${@ ima_evm_setattr_patch(d)} \
-                  "
-IMA_EVM_CFG_no = ""
-SRC_URI_append = "${IMA_EVM_CFG_${IMA_ENABLED_HERE}}"
-
-# IMA_EVM_ROOT_CA, if set, is the absolute path to a der-encoded
-# x509 CA certificate which will get compiled into the kernel.
-# The kernel will then use it to validate additional certificates,
-# like the one loaded dynamically for IMA.
-#
-# Depending on the kernel version, there are two ways to add the
-# CA certificate:
-# - For Linux < 4.3, we put the x509 file into the source directory
-#   where the kernel compilation will find it automatically
-#   (http://lxr.free-electrons.com/source/kernel/Makefile?v=4.2#L115).
-# - For Linux >= 4.3, we set SYSTEM_TRUSTED_KEYS
-#   (http://lxr.free-electrons.com/source/certs/Kconfig?v=4.3#L29).
-#   The ima_evm_root_ca.cfg only contains a blank file name.
-#   The actual file name gets patched in after the file was used
-#   to configure the kernel (see do_kernel_configme_append).
-#   This has to point to a single file, i.e. using it for IMA has to
-#   be coordinated with other usages.
-#
-# The IMA_EVM_ROOT_CA default is set globally in ima-evm-rootfs.bbclass.
-# Need weaker default here in case that ima-evm-rootfs.bbclass is not
-# inherited.
-IMA_EVM_ROOT_CA ??= ""
-
-# Add CONFIG_SYSTEM_TRUSTED_KEYS (for recent kernels) and
-# copy the root certificate into the build directory. By using
-# the normal fetcher mechanism for the certificate we ensure that
-# a rebuild is triggered when the file name or content change.
-#
-# Recompiling on name change is a bit too aggressive and causes
-# unnecessary rebuilds when only the location of the file, but not its
-# content change. This may need further work, should it become a problem
-# in practice. For example, IMA_EVM_ROOT_CA could be redefined as
-# an URL that then gets found via the normal file lookup.
-#
-# The fetcher does not expand SRC_URI. We have to enforce that here.
-IMA_EVM_ROOT_CA_CFG_yes = "${@ \
- ((' file://ima_evm_root_ca.cfg' if bb.utils.vercmp_string_op('${LINUX_VERSION}', '4.3', '>=') else '') + \
-   ' file://${IMA_EVM_ROOT_CA}') \
- if '${IMA_EVM_ROOT_CA}' else ''}"
-IMA_EVM_ROOT_CA_CFG_no = ""
-
-SRC_URI_append = "${IMA_EVM_ROOT_CA_CFG_${IMA_ENABLED_HERE}}"
-
-do_kernel_configme_append () {
-    if [ '${IMA_EVM_ROOT_CA}' ] && grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS=' ${B}/.config; then
-        # We can replace a blank value from ima_evm_root_ca.cfg,
-        # but when we find some other value, then we have to abort
-        # because we can't set more than one value.
-        eval `grep '^CONFIG_SYSTEM_TRUSTED_KEYS='`
-        if [ "$CONFIG_SYSTEM_TRUSTED_KEYS" ] && [ "$CONFIG_SYSTEM_TRUSTED_KEYS" != "${IMA_EVM_ROOT_CA}" ]; then
-            bbfatal "CONFIG_SYSTEM_TRUSTED_KEYS already set to $CONFIG_SYSTEM_TRUSTED_KEYS, cannot replace with IMA_EVM_ROOT_CA = ${IMA_EVM_ROOT_CA}"
-            exit 1
-        fi
-        pemcert=${B}/`basename ${IMA_EVM_ROOT_CA}`.pem
-        openssl x509 -inform der -in ${IMA_EVM_ROOT_CA} -out $pemcert
-        sed -i -e "s;^CONFIG_SYSTEM_TRUSTED_KEYS=.*;CONFIG_SYSTEM_TRUSTED_KEYS=\"$pemcert\";" ${B}/.config
-    fi
-}
-
-do_kernel_configme[depends] += "${@ 'openssl-native:do_populate_sysroot' if '${IMA_ENABLED_HERE}' == 'yes' and '${IMA_EVM_ROOT_CA}' else '' }"
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' file://ima.cfg', '', d)}"
-- 
2.17.1