1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
#!/bin/sh
# Licensed under the GPLv2
#
# Copyright (C) 2011 Politecnico di Torino, Italy
# TORSEC group -- http://security.polito.it
# Roberto Sassu <roberto.sassu@polito.it>
EVMSECFILE="${SECURITYFSDIR}/evm"
EVMCONFIG="${NEWROOT}/etc/sysconfig/evm"
EVMKEYDESC="evm-key"
EVMKEYTYPE="encrypted"
EVMKEYID=""
load_evm_key()
{
# read the configuration from the config file
[ -f "${EVMCONFIG}" ] && \
. ${EVMCONFIG}
# override the EVM key path name from the 'evmkey=' parameter in the kernel
# command line
EVMKEYARG=$(getarg evmkey=)
[ $? -eq 0 ] && \
EVMKEY=${EVMKEYARG}
# set the default value
[ -z "${EVMKEY}" ] && \
EVMKEY="/etc/keys/evm-trusted.blob";
# set the EVM key path name
EVMKEYPATH="${NEWROOT}${EVMKEY}"
# check for EVM encrypted key's existence
if [ ! -f "${EVMKEYPATH}" ]; then
if [ "${RD_DEBUG}" = "yes" ]; then
info "integrity: EVM encrypted key file not found: ${EVMKEYPATH}"
fi
return 1
fi
# read the EVM encrypted key blob
KEYBLOB=$(cat ${EVMKEYPATH})
# load the EVM encrypted key
EVMKEYID=$(keyctl add ${EVMKEYTYPE} ${EVMKEYDESC} "load ${KEYBLOB}" @u)
[ $? -eq 0 ] || {
info "integrity: failed to load the EVM encrypted key: ${EVMKEYDESC}";
return 1;
}
return 0
}
load_evm_x509()
{
info "Load EVM IMA X509"
# override the EVM key path name from the 'evmx509=' parameter in
# the kernel command line
EVMX509ARG=$(getarg evmx509=)
[ $? -eq 0 ] && \
EVMX509=${EVMX509ARG}
# set the default value
[ -z "${EVMX509}" ] && \
EVMX509="/etc/keys/x509_evm.der";
# set the EVM public key path name
EVMX509PATH="${NEWROOT}${EVMX509}"
# check for EVM public key's existence
if [ ! -f "${EVMX509PATH}" ]; then
if [ "${RD_DEBUG}" = "yes" ]; then
info "integrity: EVM x509 cert file not found: ${EVMX509PATH}"
fi
return 1
fi
# load the EVM public key onto the EVM keyring
evm_pubid=`keyctl newring _evm @u`
EVMX509ID=$(evmctl import ${EVMX509PATH} ${evm_pubid})
[ $? -eq 0 ] || {
info "integrity: failed to load the EVM X509 cert ${EVMX509PATH}";
return 1;
}
if [ "${RD_DEBUG}" = "yes" ]; then
keyctl show @u
fi
return 0
}
unload_evm_key()
{
# unlink the EVM encrypted key
keyctl unlink ${EVMKEYID} @u || {
info "integrity: failed to unlink the EVM encrypted key: ${EVMKEYDESC}";
return 1;
}
return 0
}
enable_evm()
{
# check kernel support for EVM
if [ ! -e "${EVMSECFILE}" ]; then
if [ "${RD_DEBUG}" = "yes" ]; then
info "integrity: EVM kernel support is disabled"
fi
return 0
fi
# load the EVM encrypted key
load_evm_key || return 1
# load the EVM public key, if it exists
load_evm_x509
# initialize EVM
info "Enabling EVM"
echo 1 > ${EVMSECFILE}
# unload the EVM encrypted key
unload_evm_key || return 1
return 0
}
enable_evm
|
