[PATCH 3/4] Define new script to load keys on the IMA keyring

[Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx>]

This patch supports loading keys either on the _ima keyring or, as of
Linux 3.17, on the trusted .ima keyring.  Only certificates signed by
a key on the system keyring can be loaded onto the trusted .ima keyring.
---
 modules.d/98integrity/ima-keys-load.sh | 62 ++++++++++++++++++++++++++++++++++
 modules.d/98integrity/module-setup.sh  |  2 ++
 2 files changed, 64 insertions(+)
 create mode 100755 modules.d/98integrity/ima-keys-load.sh

diff --git a/modules.d/98integrity/ima-keys-load.sh b/modules.d/98integrity/ima-keys-load.sh
new file mode 100755
index 0000000..659b722
--- /dev/null
+++ b/modules.d/98integrity/ima-keys-load.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+SECURITYFSDIR="/sys/kernel/security"
+IMASECDIR="${SECURITYFSDIR}/ima"
+IMACONFIG="${NEWROOT}/etc/sysconfig/ima"
+
+load_x509_keys()
+{
+    KEYRING_ID=$1
+
+    # override the default configuration
+    if [ -f "${IMACONFIG}" ]; then
+        . ${IMACONFIG}
+    fi
+
+    if [ -z "${IMAKEYDIR}" ]; then
+        IMAKEYSDIR="/etc/keys/ima"
+    fi
+
+    PUBKEY_LIST=`ls ${NEWROOT}${IMAKEYSDIR}/*`
+    for PUBKEY in ${PUBKEY_LIST}; do
+        # check for public key's existence
+        if [ ! -f "${PUBKEY}" ]; then
+            if [ "${RD_DEBUG}" = "yes" ]; then
+                info "integrity: IMA x509 cert file not found: ${PUBKEY}"
+            fi
+            continue
+        fi
+
+        X509ID=$(evmctl import ${PUBKEY} ${KEYRING_ID})
+        if [ $? -ne 0 ]; then
+            info "integrity: IMA x509 cert not loaded on keyring: ${PUBKEY}"
+        fi 
+    done
+
+    if [ "${RD_DEBUG}" = "yes" ]; then
+        keyctl show  ${KEYRING_ID}
+    fi
+    return 0
+}
+
+# check kernel support for IMA
+if [ ! -e "${IMASECDIR}" ]; then
+    if [ "${RD_DEBUG}" = "yes" ]; then
+        info "integrity: IMA kernel support is disabled"
+    fi
+    return 0
+fi
+
+# get the IMA keyring id
+line=$(keyctl describe %keyring:.ima)
+if [ $? -eq 0 ]; then
+    _ima_id=${line%%:*}
+else
+    _ima_id=`keyctl search @u keyring _ima`
+    if [ -z "${_ima_id}" ]; then
+        _ima_id=`keyctl newring _ima @u`
+    fi
+fi
+
+# load the IMA public key(s)
+load_x509_keys ${_ima_id}
diff --git a/modules.d/98integrity/module-setup.sh b/modules.d/98integrity/module-setup.sh
index 2d4d2ed..34b33cd 100755
--- a/modules.d/98integrity/module-setup.sh
+++ b/modules.d/98integrity/module-setup.sh
@@ -13,6 +13,8 @@ depends() {
 
 # called by dracut
 install() {
+    dracut_install evmctl keyctl ls
     inst_hook pre-pivot 61 "$moddir/evm-enable.sh"
+    inst_hook pre-pivot 61 "$moddir/ima-keys-load.sh"
     inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
 }
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe initramfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html