From 51238b8dd64a64284ecd939089daf68e813a23d8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 05:21:53 +0000 Subject: [PATCH 01/56] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index b6f355b..1f75f15 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,7 +1,7 @@ Summary: IMA/EVM support utilities Name: ima-evm-utils Version: 1.2.1 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2 Url: http://linux-ima.sourceforge.net/ Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz @@ -60,6 +60,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_mandir}/man1/* %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 1.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Wed Jul 31 2019 Bruno E. O. Meneguele - 1.2.1-2 - Add pull request to correct lib soname version, wich was bumped to 1.0.0 From c9a1da15a5b63ff829cb304b443ae595ae413213 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Mon, 13 Jul 2020 20:15:21 +0000 Subject: [PATCH 02/56] Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro --- ima-evm-utils.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 1f75f15..f322f84 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,7 +1,7 @@ Summary: IMA/EVM support utilities Name: ima-evm-utils Version: 1.2.1 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2 Url: http://linux-ima.sourceforge.net/ Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz @@ -37,10 +37,10 @@ This package provides the header files for %{name} mkdir -p m4 autoreconf -f -i %configure --disable-static -make %{?_smp_mflags} +%make_build %install -make DESTDIR=%{buildroot} install +%make_install find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %ldconfig_scriptlets @@ -60,6 +60,10 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_mandir}/man1/* %changelog +* Mon Jul 13 2020 Tom Stellard - 1.2.1-4 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + * Wed Jan 29 2020 Fedora Release Engineering - 1.2.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 1598285d4ecec5155f0a5bd60c19619dbd475d5a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 26 Jul 2020 13:51:27 +0100 Subject: [PATCH 03/56] v1.3 --- .gitignore | 6 +----- ima-evm-utils.spec | 49 +++++++++++++++++++++++++--------------------- sources | 3 +-- 3 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.gitignore b/.gitignore index bc5455d..2646509 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1 @@ -/ima-evm-utils-0.6.tar.gz -/ima-evm-utils-0.9.tar.gz -/ima-evm-utils-1.0.tar.gz -/ima-evm-utils-1.1.tar.gz -/ima-evm-utils-1.2.1.tar.gz +/ima-evm-utils-*.tar.gz diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index f322f84..b994570 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,20 +1,20 @@ +Name: ima-evm-utils +Version: 1.3 +Release: 1%{?dist} Summary: IMA/EVM support utilities -Name: ima-evm-utils -Version: 1.2.1 -Release: 4%{?dist} License: GPLv2 -Url: http://linux-ima.sourceforge.net/ -Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz -BuildRequires: gcc +Url: http://linux-ima.sourceforge.net/ +Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz + +BuildRequires: asciidoc BuildRequires: autoconf BuildRequires: automake +BuildRequires: gcc +BuildRequires: keyutils-libs-devel BuildRequires: libtool -BuildRequires: m4 -BuildRequires: asciidoc BuildRequires: libxslt BuildRequires: openssl-devel -BuildRequires: keyutils-libs-devel -Requires: tss2 +BuildRequires: tpm2-tss-devel %description The Trusted Computing Group(TCG) run-time Integrity Measurement Architecture @@ -26,16 +26,16 @@ ima-evm-utils is used to prepare the file system for these extended attributes. %package devel Summary: Development files for %{name} +Requires: %{name}-libs = %{version}-%{release} %description devel This package provides the header files for %{name} %prep -%setup -q +%autosetup -p1 %build -mkdir -p m4 -autoreconf -f -i +autoreconf -vif %configure --disable-static %make_build @@ -45,21 +45,26 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %ldconfig_scriptlets +%files +%license COPYING +%doc ChangeLog README AUTHORS +%{_bindir}/* +# if you need to bump the soname version, coordinate with dependent packages +%{_libdir}/libimaevm.so.2 +%{_libdir}/libimaevm.so.2.0.0 +%{_mandir}/man1/* + %files devel %{_pkgdocdir}/*.sh %{_includedir}/* %{_libdir}/libimaevm.so -%files -%doc ChangeLog README AUTHORS -%license COPYING -%{_bindir}/* -# if you need to bump the soname version, coordinate with dependent packages -%{_libdir}/libimaevm.so.1 -%{_libdir}/libimaevm.so.1.0.0 -%{_mandir}/man1/* - %changelog +* Sun Jul 26 2020 Peter Robinson - 1.3-1 +- Update to 1.3 +- Use tpm2-tss instead of tss2 +- Minor spec cleanups + * Mon Jul 13 2020 Tom Stellard - 1.2.1-4 - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro diff --git a/sources b/sources index d6f5611..66d770a 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (ima-evm-utils-1.1.tar.gz) = fc7efc890812233db888eef210dc4357bee838b56fd95efd9a9e141d684b0b354670a3c053dd93a94a1402dd826074d4a83a4637c8e6c1d90ead3132354a5776 -SHA512 (ima-evm-utils-1.2.1.tar.gz) = 0c86a838b7a30dc3b2997643002b86dccc8a4a723bccab3a306690991ff2e8e79b54cdeeab972191bd5b831cd92e6e85213827261da0a5b5e766f7d758016f3a +SHA512 (ima-evm-utils-1.3.tar.gz) = 7cc428e3ee754722c2ba287ecef1798de73917f1288f66b8f669d6ede17f9cb008ba82d4c46c507efc3c9d6d87e6c47fd6fdb6973fd097db6ee5b4449ba71f5b From 845f3885b2ef567285bce467129101ae79133e9c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 26 Jul 2020 14:07:37 +0100 Subject: [PATCH 04/56] Fix devel deps --- ima-evm-utils.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index b994570..850be83 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils Version: 1.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -26,7 +26,7 @@ ima-evm-utils is used to prepare the file system for these extended attributes. %package devel Summary: Development files for %{name} -Requires: %{name}-libs = %{version}-%{release} +Requires: %{name} = %{version}-%{release} %description devel This package provides the header files for %{name} @@ -60,6 +60,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Sun Jul 26 2020 Peter Robinson - 1.3-2 +- Fix devel deps + * Sun Jul 26 2020 Peter Robinson - 1.3-1 - Update to 1.3 - Use tpm2-tss instead of tss2 From b04b68a2718ce2b7f4479ae9513980fc1e482d35 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 01:44:05 +0000 Subject: [PATCH 05/56] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 850be83..b275e2c 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils Version: 1.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -60,6 +60,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sun Jul 26 2020 Peter Robinson - 1.3-2 - Fix devel deps From dad4a640db5684c0c9fc5d1821d8a7428b20ebfb Mon Sep 17 00:00:00 2001 From: Bruno Meneguele Date: Tue, 11 Aug 2020 11:31:20 -0300 Subject: [PATCH 06/56] Rebase to new upstream v1.3.1 minor release Resolves: BZ#1868019 Signed-off-by: Bruno Meneguele --- ima-evm-utils.spec | 9 ++++++--- sources | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index b275e2c..35e0f78 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils -Version: 1.3 -Release: 3%{?dist} +Version: 1.3.1 +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -47,7 +47,7 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %files %license COPYING -%doc ChangeLog README AUTHORS +%doc NEWS README AUTHORS %{_bindir}/* # if you need to bump the soname version, coordinate with dependent packages %{_libdir}/libimaevm.so.2 @@ -60,6 +60,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Tue Aug 11 2020 Bruno Meneguele - 1.3.1-1 +- Rebase to new upstream v1.3.1 minor release + * Tue Jul 28 2020 Fedora Release Engineering - 1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 66d770a..976d592 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ima-evm-utils-1.3.tar.gz) = 7cc428e3ee754722c2ba287ecef1798de73917f1288f66b8f669d6ede17f9cb008ba82d4c46c507efc3c9d6d87e6c47fd6fdb6973fd097db6ee5b4449ba71f5b +SHA512 (ima-evm-utils-1.3.1.tar.gz) = c1d1887bec2e365f52b7f45270ab8b9c3e794484996594f161fe1d08f3abe11ff43642199267b2352a05c820e2be87a1aeed88b90735b42c9746701844c909d0 From 406cc7e1e8d37034fc6155336a7d901d1ab96d87 Mon Sep 17 00:00:00 2001 From: Bruno Meneguele Date: Wed, 28 Oct 2020 17:57:22 -0300 Subject: [PATCH 07/56] Rebase to new upstream v1.3.2 minor release Resolves: BZ#1892415 Signed-off-by: Bruno Meneguele --- ima-evm-utils.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 35e0f78..f2255c8 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,5 +1,5 @@ Name: ima-evm-utils -Version: 1.3.1 +Version: 1.3.2 Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPLv2 @@ -60,6 +60,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Wed Oct 28 2020 Bruno Meneguele - 1.3.2-1 +- Rebase to new upstream v1.3.2 minor release + * Tue Aug 11 2020 Bruno Meneguele - 1.3.1-1 - Rebase to new upstream v1.3.1 minor release diff --git a/sources b/sources index 976d592..0270700 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ima-evm-utils-1.3.1.tar.gz) = c1d1887bec2e365f52b7f45270ab8b9c3e794484996594f161fe1d08f3abe11ff43642199267b2352a05c820e2be87a1aeed88b90735b42c9746701844c909d0 +SHA512 (ima-evm-utils-1.3.2.tar.gz) = af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db From 963df557f60e90fbcd75080e0adb40f868bed9b3 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 19 Dec 2020 00:46:34 +0000 Subject: [PATCH 08/56] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ima-evm-utils.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index f2255c8..0277518 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -15,6 +15,7 @@ BuildRequires: libtool BuildRequires: libxslt BuildRequires: openssl-devel BuildRequires: tpm2-tss-devel +BuildRequires: make %description The Trusted Computing Group(TCG) run-time Integrity Measurement Architecture From 6d8b830293833bc79b90c26d60e2c867df615691 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 14:17:04 +0000 Subject: [PATCH 09/56] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 0277518..6fbc4a9 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils Version: 1.3.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -61,6 +61,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Oct 28 2020 Bruno Meneguele - 1.3.2-1 - Rebase to new upstream v1.3.2 minor release From fdeec277f796460fc9b91a47d8aadcd19d4b593d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 08:30:10 +0000 Subject: [PATCH 10/56] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 6fbc4a9..c1f07b9 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils Version: 1.3.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -61,6 +61,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.3.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Jan 26 2021 Fedora Release Engineering - 1.3.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 87a9da9dc3ed3e8400e7e28af62cadd13f008d90 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:04:41 +0200 Subject: [PATCH 11/56] Rebuilt with OpenSSL 3.0.0 --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index c1f07b9..8c3033b 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils Version: 1.3.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -61,6 +61,9 @@ find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete %{_libdir}/libimaevm.so %changelog +* Tue Sep 14 2021 Sahana Prasad - 1.3.2-4 +- Rebuilt with OpenSSL 3.0.0 + * Thu Jul 22 2021 Fedora Release Engineering - 1.3.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From e3218f01889a6522bd725bd66b8f87265b4d18e5 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 8 Nov 2021 20:52:13 +0000 Subject: [PATCH 12/56] v1.4 --- ima-evm-utils.spec | 21 ++++++++++++--------- sources | 2 +- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 8c3033b..13a6ff0 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ Name: ima-evm-utils -Version: 1.3.2 -Release: 4%{?dist} +Version: 1.4 +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -13,9 +13,10 @@ BuildRequires: gcc BuildRequires: keyutils-libs-devel BuildRequires: libtool BuildRequires: libxslt +BuildRequires: make BuildRequires: openssl-devel BuildRequires: tpm2-tss-devel -BuildRequires: make + %description The Trusted Computing Group(TCG) run-time Integrity Measurement Architecture @@ -42,25 +43,27 @@ autoreconf -vif %install %make_install -find %{buildroot}%{_libdir} -type f -name "*.la" -print -delete +find %{buildroot} -type f -name "*.la" -delete %ldconfig_scriptlets %files %license COPYING %doc NEWS README AUTHORS -%{_bindir}/* +%{_bindir}/evmctl # if you need to bump the soname version, coordinate with dependent packages -%{_libdir}/libimaevm.so.2 -%{_libdir}/libimaevm.so.2.0.0 -%{_mandir}/man1/* +%{_libdir}/libimaevm.so.3* +%{_mandir}/man1/evmctl* %files devel %{_pkgdocdir}/*.sh -%{_includedir}/* +%{_includedir}/imaevm.h %{_libdir}/libimaevm.so %changelog +* Mon Nov 08 2021 Peter Robinson - 1.4-1 +- Update to 1.4 + * Tue Sep 14 2021 Sahana Prasad - 1.3.2-4 - Rebuilt with OpenSSL 3.0.0 diff --git a/sources b/sources index 0270700..a03a3da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ima-evm-utils-1.3.2.tar.gz) = af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db +SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 From 0602436823af9d2e27c6259e75c3931954207e6a Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Jan 2022 15:19:26 +0000 Subject: [PATCH 13/56] Build with compatible for bootstrap --- ima-evm-utils.spec | 66 +++++++++++++++++++++++++++++++++++++++++++--- sources | 1 + 2 files changed, 64 insertions(+), 3 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 13a6ff0..857df71 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,11 +1,32 @@ +%bcond_with compat + +# For cases where the soname requires a bump we need to define with_compat, +# update the package into the side-tag, update RPM (rpm-sign) into side-tag, +# _then_ undefine with_compat and rebuild the package into the side-tag. This +# is required to workaround the chiken-egg situation with the rpm-sign update. +# The compat pkg must not make the compose, it's only a buildrequirement for +# rpm-sign in a soname bump. +%if ! %{with compat} +%undefine with_compat +%endif + +%if %{with compat} +%global compat_soversion 2 +%endif + Name: ima-evm-utils Version: 1.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz +# compat source and patches +Source10: ima-evm-utils-1.3.2.tar.gz +Patch10: 0001-evmctl-fix-memory-leak-in-get_password.patch +Patch11: 0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch + BuildRequires: asciidoc BuildRequires: autoconf BuildRequires: automake @@ -17,7 +38,6 @@ BuildRequires: make BuildRequires: openssl-devel BuildRequires: tpm2-tss-devel - %description The Trusted Computing Group(TCG) run-time Integrity Measurement Architecture (IMA) maintains a list of hash values of executables and other sensitive @@ -33,18 +53,49 @@ Requires: %{name} = %{version}-%{release} %description devel This package provides the header files for %{name} +%if %{with compat} +%package -n %{name}%{compat_soversion} +Summary: Compatibility package of %{name} + +%description -n %{name}%{compat_soversion} +This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1.3 +%endif + %prep -%autosetup -p1 +%setup -q + +%if %{with compat} +mkdir compat/ +tar -zxf %{SOURCE10} --strip-components=1 -C compat/ +cd compat/ +%patch10 -p1 +%patch11 -p1 +%endif %build autoreconf -vif %configure --disable-static %make_build +%if %{with compat} +pushd compat/ +autoreconf -vif +%configure --disable-static +%make_build +popd +%endif + %install %make_install find %{buildroot} -type f -name "*.la" -delete +%if %{with compat} +pushd compat/src/.libs/ +install -p libimaevm.so.%{compat_soversion}.0.0 %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 +ln -s -f %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion} +popd +%endif + %ldconfig_scriptlets %files @@ -60,7 +111,16 @@ find %{buildroot} -type f -name "*.la" -delete %{_includedir}/imaevm.h %{_libdir}/libimaevm.so +%if %{with compat} +%files -n %{name}%{compat_soversion} +%{_libdir}/libimaevm.so.%{compat_soversion} +%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 +%endif + %changelog +* Tue Jan 18 2022 Peter Robinson - 1.4-2 +- Add compat bootstrap sub package + * Mon Nov 08 2021 Peter Robinson - 1.4-1 - Update to 1.4 diff --git a/sources b/sources index a03a3da..9c14713 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ +SHA512 (ima-evm-utils-1.3.2.tar.gz) = af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 From 3164e5a1c5f85f43e0b552900002c0bd8f2d313d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Jan 2022 15:25:33 +0000 Subject: [PATCH 14/56] add patches for compat build --- ...mctl-fix-memory-leak-in-get_password.patch | 38 ++++++++++++ ...e-SHA-256-the-default-hash-algorithm.patch | 61 +++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 0001-evmctl-fix-memory-leak-in-get_password.patch create mode 100644 0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch diff --git a/0001-evmctl-fix-memory-leak-in-get_password.patch b/0001-evmctl-fix-memory-leak-in-get_password.patch new file mode 100644 index 0000000..e6657d1 --- /dev/null +++ b/0001-evmctl-fix-memory-leak-in-get_password.patch @@ -0,0 +1,38 @@ +From 2f1740eab432abc8e85172531d97eba33342474c Mon Sep 17 00:00:00 2001 +From: Bruno Meneguele +Date: Mon, 16 Aug 2021 12:11:15 -0300 +Subject: [PATCH] evmctl: fix memory leak in get_password + +The variable "password" is not freed nor returned in case get_password() +succeeds. Return it instead of the intermediary variable "pwd". Issue found +by Coverity scan tool. + +src/evmctl.c:2565: leaked_storage: Variable "password" going out of scope + leaks the storage it points to. + +Signed-off-by: Bruno Meneguele +--- + src/evmctl.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/evmctl.c b/src/evmctl.c +index a8065bbe124a..ab7173723095 100644 +--- a/src/evmctl.c ++++ b/src/evmctl.c +@@ -2625,7 +2625,12 @@ static char *get_password(void) + return NULL; + } + +- return pwd; ++ if (pwd == NULL) { ++ free(password); ++ return NULL; ++ } ++ ++ return password; + } + + int main(int argc, char *argv[]) +-- +2.31.1 + diff --git a/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch b/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch new file mode 100644 index 0000000..e6dc92d --- /dev/null +++ b/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch @@ -0,0 +1,61 @@ +From 916a0f97fd244a48fde429a63ddc04ed1ed94f8b Mon Sep 17 00:00:00 2001 +From: Bruno Meneguele +Date: Mon, 16 Aug 2021 17:58:35 -0300 +Subject: [PATCH] libimaevm: make SHA-256 the default hash algorithm + +The SHA-1 algorithm is considered a weak hash algorithm and there has been +some movement within certain distros to drop its support completely or at +least drop it from the default behavior. ima-evm-utils uses it as the +default algorithm in case the user doesn't explicitly ask for another +through the --hashalgo/-a option. With that, make SHA-256 the default hash +algorithm instead. + +Signed-off-by: Bruno Meneguele +--- + README | 2 +- + src/evmctl.c | 2 +- + src/libimaevm.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/README b/README +index 87cd3b5cd7da..0dc02f551673 100644 +--- a/README ++++ b/README +@@ -41,7 +41,7 @@ COMMANDS + OPTIONS + ------- + +- -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512 ++ -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512 + -s, --imasig make IMA signature + -d, --imahash make IMA hash + -f, --sigfile store IMA signature in .sig file instead of xattr +diff --git a/src/evmctl.c b/src/evmctl.c +index a8065bbe124a..e0e55bc0b122 100644 +--- a/src/evmctl.c ++++ b/src/evmctl.c +@@ -2496,7 +2496,7 @@ static void usage(void) + + printf( + "\n" +- " -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n" ++ " -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512, streebog256, streebog512\n" + " -s, --imasig make IMA signature\n" + " -d, --imahash make IMA hash\n" + " -f, --sigfile store IMA signature in .sig file instead of xattr\n" +diff --git a/src/libimaevm.c b/src/libimaevm.c +index 8e9615796153..f6c72b878d88 100644 +--- a/src/libimaevm.c ++++ b/src/libimaevm.c +@@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = { + struct libimaevm_params imaevm_params = { + .verbose = LOG_INFO, + .x509 = 1, +- .hash_algo = "sha1", ++ .hash_algo = "sha256", + }; + + static void __attribute__ ((constructor)) libinit(void); +-- +2.31.1 + From b6235bcbb3ef1e687e5592700912205dac657a24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 19 Jan 2022 18:14:44 +0100 Subject: [PATCH 15/56] Actually enable compat bcond --- ima-evm-utils.spec | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 857df71..906576f 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,14 +1,11 @@ -%bcond_with compat - # For cases where the soname requires a bump we need to define with_compat, # update the package into the side-tag, update RPM (rpm-sign) into side-tag, # _then_ undefine with_compat and rebuild the package into the side-tag. This # is required to workaround the chiken-egg situation with the rpm-sign update. # The compat pkg must not make the compose, it's only a buildrequirement for # rpm-sign in a soname bump. -%if ! %{with compat} -%undefine with_compat -%endif +%bcond_without compat + %if %{with compat} %global compat_soversion 2 From e87fd6c09a3eb8e14aaa857c035cd78c6d1b64e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Thu, 20 Jan 2022 06:36:24 +0100 Subject: [PATCH 16/56] Build with compat bootstrap sub package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 906576f..cd6b24e 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -13,7 +13,7 @@ Name: ima-evm-utils Version: 1.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -115,6 +115,9 @@ popd %endif %changelog +* Thu Jan 20 2022 Björn Esser - 1.4-3 +- Build with compat bootstrap sub package + * Tue Jan 18 2022 Peter Robinson - 1.4-2 - Add compat bootstrap sub package From 65d5e121c865ac5f8c0ef562143e7de3042a5297 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Thu, 20 Jan 2022 06:48:34 +0100 Subject: [PATCH 17/56] Build without compat bootstrap sub package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ...mctl-fix-memory-leak-in-get_password.patch | 38 ------------ ...e-SHA-256-the-default-hash-algorithm.patch | 61 ------------------- ima-evm-utils.spec | 20 +++--- sources | 1 - 4 files changed, 10 insertions(+), 110 deletions(-) delete mode 100644 0001-evmctl-fix-memory-leak-in-get_password.patch delete mode 100644 0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch diff --git a/0001-evmctl-fix-memory-leak-in-get_password.patch b/0001-evmctl-fix-memory-leak-in-get_password.patch deleted file mode 100644 index e6657d1..0000000 --- a/0001-evmctl-fix-memory-leak-in-get_password.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 2f1740eab432abc8e85172531d97eba33342474c Mon Sep 17 00:00:00 2001 -From: Bruno Meneguele -Date: Mon, 16 Aug 2021 12:11:15 -0300 -Subject: [PATCH] evmctl: fix memory leak in get_password - -The variable "password" is not freed nor returned in case get_password() -succeeds. Return it instead of the intermediary variable "pwd". Issue found -by Coverity scan tool. - -src/evmctl.c:2565: leaked_storage: Variable "password" going out of scope - leaks the storage it points to. - -Signed-off-by: Bruno Meneguele ---- - src/evmctl.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/evmctl.c b/src/evmctl.c -index a8065bbe124a..ab7173723095 100644 ---- a/src/evmctl.c -+++ b/src/evmctl.c -@@ -2625,7 +2625,12 @@ static char *get_password(void) - return NULL; - } - -- return pwd; -+ if (pwd == NULL) { -+ free(password); -+ return NULL; -+ } -+ -+ return password; - } - - int main(int argc, char *argv[]) --- -2.31.1 - diff --git a/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch b/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch deleted file mode 100644 index e6dc92d..0000000 --- a/0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 916a0f97fd244a48fde429a63ddc04ed1ed94f8b Mon Sep 17 00:00:00 2001 -From: Bruno Meneguele -Date: Mon, 16 Aug 2021 17:58:35 -0300 -Subject: [PATCH] libimaevm: make SHA-256 the default hash algorithm - -The SHA-1 algorithm is considered a weak hash algorithm and there has been -some movement within certain distros to drop its support completely or at -least drop it from the default behavior. ima-evm-utils uses it as the -default algorithm in case the user doesn't explicitly ask for another -through the --hashalgo/-a option. With that, make SHA-256 the default hash -algorithm instead. - -Signed-off-by: Bruno Meneguele ---- - README | 2 +- - src/evmctl.c | 2 +- - src/libimaevm.c | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/README b/README -index 87cd3b5cd7da..0dc02f551673 100644 ---- a/README -+++ b/README -@@ -41,7 +41,7 @@ COMMANDS - OPTIONS - ------- - -- -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512 -+ -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512 - -s, --imasig make IMA signature - -d, --imahash make IMA hash - -f, --sigfile store IMA signature in .sig file instead of xattr -diff --git a/src/evmctl.c b/src/evmctl.c -index a8065bbe124a..e0e55bc0b122 100644 ---- a/src/evmctl.c -+++ b/src/evmctl.c -@@ -2496,7 +2496,7 @@ static void usage(void) - - printf( - "\n" -- " -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n" -+ " -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512, streebog256, streebog512\n" - " -s, --imasig make IMA signature\n" - " -d, --imahash make IMA hash\n" - " -f, --sigfile store IMA signature in .sig file instead of xattr\n" -diff --git a/src/libimaevm.c b/src/libimaevm.c -index 8e9615796153..f6c72b878d88 100644 ---- a/src/libimaevm.c -+++ b/src/libimaevm.c -@@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = { - struct libimaevm_params imaevm_params = { - .verbose = LOG_INFO, - .x509 = 1, -- .hash_algo = "sha1", -+ .hash_algo = "sha256", - }; - - static void __attribute__ ((constructor)) libinit(void); --- -2.31.1 - diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index cd6b24e..d4370e1 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -4,25 +4,25 @@ # is required to workaround the chiken-egg situation with the rpm-sign update. # The compat pkg must not make the compose, it's only a buildrequirement for # rpm-sign in a soname bump. -%bcond_without compat +%bcond_with compat %if %{with compat} -%global compat_soversion 2 +%global compat_soversion 3 %endif Name: ima-evm-utils Version: 1.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ -Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz +Source0: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz # compat source and patches -Source10: ima-evm-utils-1.3.2.tar.gz -Patch10: 0001-evmctl-fix-memory-leak-in-get_password.patch -Patch11: 0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch +%if %{with compat} +Source10: ima-evm-utils-1.4.tar.gz +%endif BuildRequires: asciidoc BuildRequires: autoconf @@ -64,9 +64,6 @@ This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1 %if %{with compat} mkdir compat/ tar -zxf %{SOURCE10} --strip-components=1 -C compat/ -cd compat/ -%patch10 -p1 -%patch11 -p1 %endif %build @@ -115,6 +112,9 @@ popd %endif %changelog +* Thu Jan 20 2022 Björn Esser - 1.4-4 +- Build without compat bootstrap sub package + * Thu Jan 20 2022 Björn Esser - 1.4-3 - Build with compat bootstrap sub package diff --git a/sources b/sources index 9c14713..a03a3da 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (ima-evm-utils-1.3.2.tar.gz) = af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 From 558c3df69c58d388dfa396586d88925cdb9feb01 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 13:13:49 +0000 Subject: [PATCH 18/56] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index d4370e1..803d35f 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -13,7 +13,7 @@ Name: ima-evm-utils Version: 1.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -112,6 +112,9 @@ popd %endif %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Jan 20 2022 Björn Esser - 1.4-4 - Build without compat bootstrap sub package From c7ba98a6ec6d35a220d666f257910ce3cadf4a67 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 14:35:25 +0000 Subject: [PATCH 19/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 803d35f..b791016 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -13,7 +13,7 @@ Name: ima-evm-utils Version: 1.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -112,6 +112,9 @@ popd %endif %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Jan 20 2022 Fedora Release Engineering - 1.4-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From eeac9f2aed417e5d66e47b8f7418ae3b693be84f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:05:15 +0000 Subject: [PATCH 20/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index b791016..9902d5e 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -13,7 +13,7 @@ Name: ima-evm-utils Version: 1.4 -Release: 6%{?dist} +Release: 7%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -112,6 +112,9 @@ popd %endif %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.4-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jul 21 2022 Fedora Release Engineering - 1.4-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 631781e5b2fa6f61b09f868ad496547a08e00b97 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 8 Jun 2023 09:31:11 +0100 Subject: [PATCH 21/56] 1.5, updates for bootstrapping --- ima-evm-utils.spec | 61 ++++++++++++++++++++-------------------------- sources | 1 + 2 files changed, 28 insertions(+), 34 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 9902d5e..4db8fe1 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,26 +1,21 @@ -# For cases where the soname requires a bump we need to define with_compat, -# update the package into the side-tag, update RPM (rpm-sign) into side-tag, -# _then_ undefine with_compat and rebuild the package into the side-tag. This -# is required to workaround the chiken-egg situation with the rpm-sign update. -# The compat pkg must not make the compose, it's only a buildrequirement for -# rpm-sign in a soname bump. -%bcond_with compat +# If the soname gets bumped we need to ship a compat library to be able +# to bootstrap and rebuild rpm else we end up with chicken and egg problem. +%global bootstrap 1 - -%if %{with compat} +%if 0%{bootstrap} %global compat_soversion 3 %endif Name: ima-evm-utils -Version: 1.4 -Release: 7%{?dist} +Version: 1.5 +Release: 0.1%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ -Source0: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz +Source0: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz +%if 0%{bootstrap} # compat source and patches -%if %{with compat} Source10: ima-evm-utils-1.4.tar.gz %endif @@ -50,31 +45,25 @@ Requires: %{name} = %{version}-%{release} %description devel This package provides the header files for %{name} -%if %{with compat} -%package -n %{name}%{compat_soversion} -Summary: Compatibility package of %{name} - -%description -n %{name}%{compat_soversion} -This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1.3 -%endif - %prep %setup -q -%if %{with compat} +%if 0%{bootstrap} mkdir compat/ -tar -zxf %{SOURCE10} --strip-components=1 -C compat/ +pushd compat/ +tar -zxf %{SOURCE10} --strip-components=1 +popd %endif %build autoreconf -vif -%configure --disable-static +%configure --disable-static --disable-engine %make_build -%if %{with compat} +%if 0%{bootstrap} pushd compat/ autoreconf -vif -%configure --disable-static +%configure --disable-static --disable-engine %make_build popd %endif @@ -83,7 +72,7 @@ popd %make_install find %{buildroot} -type f -name "*.la" -delete -%if %{with compat} +%if 0%{bootstrap} pushd compat/src/.libs/ install -p libimaevm.so.%{compat_soversion}.0.0 %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 ln -s -f %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 %{buildroot}%{_libdir}/libimaevm.so.%{compat_soversion} @@ -97,21 +86,25 @@ popd %doc NEWS README AUTHORS %{_bindir}/evmctl # if you need to bump the soname version, coordinate with dependent packages -%{_libdir}/libimaevm.so.3* +%{_libdir}/libimaevm.so.4* %{_mandir}/man1/evmctl* +%if 0%{bootstrap} +%{_libdir}/libimaevm.so.%{compat_soversion} +%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 +%endif %files devel %{_pkgdocdir}/*.sh %{_includedir}/imaevm.h %{_libdir}/libimaevm.so -%if %{with compat} -%files -n %{name}%{compat_soversion} -%{_libdir}/libimaevm.so.%{compat_soversion} -%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 -%endif - %changelog +* Wed Jun 07 2023 Peter Robinson - 1.5-0.1 +- Update to 1.5 +- Streamline bootstrap process a little +- Bootstrap mode +- Update download URL + * Thu Jan 19 2023 Fedora Release Engineering - 1.4-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index a03a3da..5c19b08 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 +SHA512 (ima-evm-utils-1.5.tar.gz) = a1f0f2441dd1c41044f1b9a2151c53a02ed539dc1317950c4f8d72ec6340b2ac464bd572e6b0971bc2fe5dcc1842013f5698fe1bf2de92524ae0891c24daa417 From 196c5116521143b5a26e46f394e5c99c03b87f51 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 8 Jun 2023 10:45:50 +0100 Subject: [PATCH 22/56] Disable bootstrap --- ima-evm-utils.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 4db8fe1..77b3c05 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ # If the soname gets bumped we need to ship a compat library to be able # to bootstrap and rebuild rpm else we end up with chicken and egg problem. -%global bootstrap 1 +%global bootstrap 0 %if 0%{bootstrap} %global compat_soversion 3 @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.5 -Release: 0.1%{?dist} +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -99,6 +99,9 @@ popd %{_libdir}/libimaevm.so %changelog +* Thu Jun 08 2023 Peter Robinson - 1.5-1 +- Disable bootstrap + * Wed Jun 07 2023 Peter Robinson - 1.5-0.1 - Update to 1.5 - Streamline bootstrap process a little From 9f48b2423412e5a6188a4c859c2132096fd24dfc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:20:43 +0000 Subject: [PATCH 23/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 77b3c05..37db724 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -99,6 +99,9 @@ popd %{_libdir}/libimaevm.so %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Jun 08 2023 Peter Robinson - 1.5-1 - Disable bootstrap From bd167794624bacd0d1f1cf6554460886480a66ca Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:00:52 +0000 Subject: [PATCH 24/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 37db724..49712ab 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -99,6 +99,9 @@ popd %{_libdir}/libimaevm.so %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 1.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 20 2023 Fedora Release Engineering - 1.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 428c33916ccf647b0ade731031cce5b4a1e10e01 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:39:14 +0000 Subject: [PATCH 25/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 49712ab..ca70631 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: IMA/EVM support utilities License: GPLv2 Url: http://linux-ima.sourceforge.net/ @@ -99,6 +99,9 @@ popd %{_libdir}/libimaevm.so %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 1.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 1.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 25a3b5ce1d1fec30d609526bbb66697ed8280657 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Tue, 16 Jan 2024 16:17:49 +0800 Subject: [PATCH 26/56] Use SPDX licenses Convert to SPDX license according to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2, # license-fedora2spdx GPLv2 GPL-2.0-only src/{evmctl.c,libimaevm.c} use "GPL-2.0-only WITH cryptsetup-OpenSSL-exception" and hash_info.h uses "GPL-2.0-or-later WITH Linux-syscall-note". Add these licenses as well. Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index ca70631..d478d02 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -10,7 +10,7 @@ Name: ima-evm-utils Version: 1.5 Release: 4%{?dist} Summary: IMA/EVM support utilities -License: GPLv2 +License: GPL-2.0-only AND GPL-2.0-only WITH cryptsetup-OpenSSL-exception AND GPL-2.0-or-later WITH Linux-syscall-note Url: http://linux-ima.sourceforge.net/ Source0: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz From 166b1dccdbad87750849c23b9f3a8e77cbc1950f Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 6 Jun 2024 08:39:16 +0800 Subject: [PATCH 27/56] Add ima-evm-utils-libs subpackage Quoting Peter, > split out /usr/lib64/libimaevm.so.* to ima-evm-utils-libs so that for > users that don't need IMA they just have the library and then the > tools/utils are only installed for those that want IMA and we can add > deps on keyutils and rpm-plugin-ima Suggested-by: Peter Robinson Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index d478d02..317d581 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -38,9 +38,16 @@ systems extended attributes. The Extended Verification Module (EVM) prevents unauthorized changes to these extended attributes on the file system. ima-evm-utils is used to prepare the file system for these extended attributes. +%package libs +Summary: Libraries for %{name} + +%description libs +This package contains the libraries for applications to use +ima-evm-utils functionality. + %package devel Summary: Development files for %{name} -Requires: %{name} = %{version}-%{release} +Requires: %{name}-libs = %{version}-%{release} %description devel This package provides the header files for %{name} @@ -85,9 +92,11 @@ popd %license COPYING %doc NEWS README AUTHORS %{_bindir}/evmctl +%{_mandir}/man1/evmctl* + +%files libs # if you need to bump the soname version, coordinate with dependent packages %{_libdir}/libimaevm.so.4* -%{_mandir}/man1/evmctl* %if 0%{bootstrap} %{_libdir}/libimaevm.so.%{compat_soversion} %{_libdir}/libimaevm.so.%{compat_soversion}.0.0 From 8980421a049c776e2b77e534793aafb925b3ad48 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 6 May 2024 17:48:52 +0800 Subject: [PATCH 28/56] Add some IMA setup tools Some IMA setup tools are added to ease IMA setup which will do the following tasks, - add IMA signatures to installed packages files - load IMA keys and policy - enable the dracut integrity module to load IMA keys and policy automatically Two IMA polices as suggested by Stefan Berger are also provided which will be signed automatically with other package files. Thanks to Marko Myllynen for coming up with the idea to have a tool similar to fips-mode-setup. And thanks to Mimi Zohar and Stefan Berger for providing the feedback! Signed-off-by: Coiby Xu --- dracut-98-integrity.conf | 1 + ima-add-sigs.sh | 82 ++++++++++++ ima-evm-utils.spec | 31 +++++ ima-setup.sh | 118 ++++++++++++++++++ ...01-appraise-exectuables-and-lib-signatures | 2 + policy-02-keylime-remote-attestation | 37 ++++++ policy_list | 2 + 7 files changed, 273 insertions(+) create mode 100644 dracut-98-integrity.conf create mode 100755 ima-add-sigs.sh create mode 100755 ima-setup.sh create mode 100644 policy-01-appraise-exectuables-and-lib-signatures create mode 100644 policy-02-keylime-remote-attestation create mode 100644 policy_list diff --git a/dracut-98-integrity.conf b/dracut-98-integrity.conf new file mode 100644 index 0000000..0996b9a --- /dev/null +++ b/dracut-98-integrity.conf @@ -0,0 +1 @@ +add_dracutmodules+=" integrity " diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh new file mode 100755 index 0000000..eadd629 --- /dev/null +++ b/ima-add-sigs.sh @@ -0,0 +1,82 @@ +#!/bin/bash +# +# This script add IMA signatures to installed RPM package files +# Usage: add_ima_sigs.sh [[ALL|PACKAGE_NAME] IMA_CERT_PATH] +# +# By default, it will add IMA sigantures to all installed package files. Or you +# can provide a package name to only add IMA signature for files of specicifed +# package. If it detects >=20 packages (or 1 package if you specify a package +# name) missing signatures in the RPM database, it will reinstall the packages +# in order to get the IMA signatures. +# +# With the signing IMA cert path specified, it will also try to verify +# the added IMA signature. + +if [[ -z "$1" || $1 == ALL ]]; then + package="--all" +else + package=$1 +fi + +ima_cert=$2 + +abort() { + echo "$1" + exit 1 +} + +# Add IMA signatures from RPM database +add_from_rpm_db() { + if ! command -v setfattr &>/dev/null; then + abort "Please install attr" + fi + + # use "|" as deliminator since it won't be used in a filename or signature + while IFS="|" read -r path sig; do + # [[ -z "$sig" ]] somehow doesn't work for some files that don't have IMA + # signatures. This may be a issue of rpm + if [[ "$sig" != "0"* ]]; then + continue + fi + + # Skip directory, soft links, non-existent files and vfat fs + if [[ -d "$path" || -L "$path" || ! -f "$path" || "$path" == "/boot/efi/EFI/"* ]]; then + continue + fi + + if ! setfattr -n security.ima "$path" -v "0x$sig"; then + echo "Failed to add IMA sig for $path" + fi + + [[ -e "$ima_cert" ]] || continue + # TODO + # don't verify the modified files like /etc? + if ! evmctl ima_verify -k "$ima_cert" "$path" &>/dev/null; then + echo "Failed to verify $path" + fi + done < <(rpm -q --queryformat "[%{FILENAMES}|%{FILESIGNATURES}\n]" "$package") +} + +# Add IMA signatures by reinstalling all packages +add_by_reinstall() { + [[ $package == "--all" ]] && package='*' + dnf reinstall "$package" -yq >/dev/null +} + +if [[ $package == "--all" ]]; then + reinstall_threshold=20 +else + if ! rpm -q --quiet $package; then + dnf install "$package" -yq >/dev/null + exit 0 + fi + reinstall_threshold=1 +fi + +unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" $package | grep "^(none)$" | wc -l) + +if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then + add_by_reinstall +else + add_from_rpm_db +fi diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 317d581..a57cd78 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -14,6 +14,14 @@ License: GPL-2.0-only AND GPL-2.0-only WITH cryptsetup-OpenSSL-exception AND GPL Url: http://linux-ima.sourceforge.net/ Source0: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz +# IMA setup tools +Source2: dracut-98-integrity.conf +Source3: ima-add-sigs.sh +Source4: ima-setup.sh +Source100: policy-01-appraise-exectuables-and-lib-signatures +Source101: policy-02-keylime-remote-attestation +Source200: policy_list + %if 0%{bootstrap} # compat source and patches Source10: ima-evm-utils-1.4.tar.gz @@ -29,6 +37,10 @@ BuildRequires: libxslt BuildRequires: make BuildRequires: openssl-devel BuildRequires: tpm2-tss-devel +Requires: %{name}-libs = %{version}-%{release} +Requires: rpm-plugin-ima +Requires: keyutils +Requires: attr %description The Trusted Computing Group(TCG) run-time Integrity Measurement Architecture @@ -88,12 +100,31 @@ popd %ldconfig_scriptlets +# IMA setup tools +install -D -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_datadir}/ima/dracut-98-integrity.conf + +mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/ima/policies +while IFS= read -r policy_file +do + install -m 644 %{_sourcedir}/policy-"$policy_file" $RPM_BUILD_ROOT%{_datadir}/ima/policies/"$policy_file" +done < %{SOURCE200} + +install -D %{SOURCE3} $RPM_BUILD_ROOT%{_bindir}/ima-add-sigs +install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup + %files %license COPYING %doc NEWS README AUTHORS %{_bindir}/evmctl %{_mandir}/man1/evmctl* +# IMA setup tools +%{_datadir}/ima/policies +%{_datadir}/ima/dracut-98-integrity.conf +%{_bindir}/ima-add-sigs +%{_bindir}/ima-setup + + %files libs # if you need to bump the soname version, coordinate with dependent packages %{_libdir}/libimaevm.so.4* diff --git a/ima-setup.sh b/ima-setup.sh new file mode 100755 index 0000000..6816d7d --- /dev/null +++ b/ima-setup.sh @@ -0,0 +1,118 @@ +#!/bin/bash +# +# This script helps set up IMA. +# +IMA_SYSTEMD_POLICY=/etc/ima/ima-policy +IMA_POLICY_SYSFS=/sys/kernel/security/ima/policy + +usage() { + echo "Set up IMA." + cat </dev/null; then + echo "Failed to load IMA key ${i}" + else + _key_loaded=yes + fi + done + + if [[ $_key_loaded != yes ]]; then + echo "No IMA key loaded" + exit 1 + fi +} + +load_ima_policy() { + local ima_policy_path + + ima_policy_path=$1 + + if ! test -f "$ima_policy_path"; then + echo "$ima_policy_path doesn't exist" + return 1 + fi + if ! echo "$ima_policy_path" >"$IMA_POLICY_SYSFS"; then + echo "$ima_policy_path can't be loaded" + return 1 + fi + # Let systemd load the IMA policy which will load LSM rules first so IMA + # policy containing rules like "appraise obj_type=ifconfig_exec_t" can be + # loaded + [[ -e /etc/ima ]] || mkdir -p /etc/ima/ + if ! cp --preserve=xattr "$ima_policy_path" "$IMA_SYSTEMD_POLICY"; then + echo "Failed to copy $ima_policy_path to $IMA_SYSTEMD_POLICY" + return 1 + fi +} + +echo "Loading IMA keys" +load_ima_keys + +# Include the dracut integrity module to load the IMA keys and policy +# automatically when there is a system reboot +if ! lsinitrd --mod | grep -q integrity; then + cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf + echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module" + dracut -f +fi + +if ! load_ima_policy "$ima_policy_path"; then + echo "Failed to load IMA policy $ima_policy_path!" + exit 1 +fi diff --git a/policy-01-appraise-exectuables-and-lib-signatures b/policy-01-appraise-exectuables-and-lib-signatures new file mode 100644 index 0000000..afc4530 --- /dev/null +++ b/policy-01-appraise-exectuables-and-lib-signatures @@ -0,0 +1,2 @@ +appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig +appraise func=BPRM_CHECK appraise_type=imasig diff --git a/policy-02-keylime-remote-attestation b/policy-02-keylime-remote-attestation new file mode 100644 index 0000000..5210734 --- /dev/null +++ b/policy-02-keylime-remote-attestation @@ -0,0 +1,37 @@ +# PROC_SUPER_MAGIC +dont_measure fsmagic=0x9fa0 +# SYSFS_MAGIC +dont_measure fsmagic=0x62656572 +# DEBUGFS_MAGIC +dont_measure fsmagic=0x64626720 +# TMPFS_MAGIC +dont_measure fsmagic=0x01021994 +# DEVPTS_SUPER_MAGIC +dont_measure fsmagic=0x1cd1 +# BINFMTFS_MAGIC +dont_measure fsmagic=0x42494e4d +# SECURITYFS_MAGIC +dont_measure fsmagic=0x73636673 +# SELINUX_MAGIC +dont_measure fsmagic=0xf97cff8c +# SMACK_MAGIC +dont_measure fsmagic=0x43415d53 +# CGROUP_SUPER_MAGIC +dont_measure fsmagic=0x27e0eb +# CGROUP2_SUPER_MAGIC +dont_measure fsmagic=0x63677270 +# NSFS_MAGIC +dont_measure fsmagic=0x6e736673 +# EFIVARFS_MAGIC +dont_measure fsmagic=0xde5e81e4 +# OVERLAYFS_MAGIC +# when containers are used we almost always want to ignore them +dont_measure fsmagic=0x794c7630 + + +# Measure and log keys loaded onto the .ima keyring +measure func=KEY_CHECK keyrings=.ima +# Measure and log executables +measure func=BPRM_CHECK +# Measure and log shared libraries +measure func=FILE_MMAP mask=MAY_EXEC diff --git a/policy_list b/policy_list new file mode 100644 index 0000000..23ff71a --- /dev/null +++ b/policy_list @@ -0,0 +1,2 @@ +01-appraise-exectuables-and-lib-signatures +02-keylime-remote-attestation From 141a74d96ab3cdee1b0d2cf6a0cba19337920e02 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Tue, 28 May 2024 09:54:19 +0800 Subject: [PATCH 29/56] ima-setup: Allow users to specify custom reinstall_threshold Some users may use custom built packages and we are not sure about the number of this type of packages. So make reinstall_threshold configurable. Suggested-by: Marko Myllynen --- ima-add-sigs.sh | 43 +++++++++++++++++++++++++++++-------------- ima-setup.sh | 10 +++++++++- 2 files changed, 38 insertions(+), 15 deletions(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index eadd629..4321ace 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -1,7 +1,7 @@ #!/bin/bash # # This script add IMA signatures to installed RPM package files -# Usage: add_ima_sigs.sh [[ALL|PACKAGE_NAME] IMA_CERT_PATH] +# Usage: add_ima_sigs.sh [--package=PACKAGE_NAME|ALL] [--ima-cert=IMA_CERT_PATH] [--reinstall_threshold=NUM] # # By default, it will add IMA sigantures to all installed package files. Or you # can provide a package name to only add IMA signature for files of specicifed @@ -12,13 +12,26 @@ # With the signing IMA cert path specified, it will also try to verify # the added IMA signature. -if [[ -z "$1" || $1 == ALL ]]; then - package="--all" -else - package=$1 -fi +for _opt in "$@"; do + case "$_opt" in + --reinstall_threshold=*) + reinstall_threshold=${_opt#*=} + ;; + --package=*) + package=${_opt#*=} + ;; + --ima_cert=*) + ima_cert=${_opt#*=} + ;; + *) + usage + ;; + esac +done -ima_cert=$2 +if [[ -z $package ]] || [[ $package == ALL ]]; then + package="--all" +fi abort() { echo "$1" @@ -63,14 +76,16 @@ add_by_reinstall() { dnf reinstall "$package" -yq >/dev/null } -if [[ $package == "--all" ]]; then - reinstall_threshold=20 -else - if ! rpm -q --quiet $package; then - dnf install "$package" -yq >/dev/null - exit 0 +if [[ -z $reinstall_threshold ]]; then + if [[ $package == "--all" ]]; then + reinstall_threshold=20 + else + if ! rpm -q --quiet $package; then + dnf install "$package" -yq >/dev/null + exit 0 + fi + reinstall_threshold=1 fi - reinstall_threshold=1 fi unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" $package | grep "^(none)$" | wc -l) diff --git a/ima-setup.sh b/ima-setup.sh index 6816d7d..34dd33d 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -8,13 +8,18 @@ IMA_POLICY_SYSFS=/sys/kernel/security/ima/policy usage() { echo "Set up IMA." cat <reinstall_threshold packages in the RPM DB missing IMA signatures, reinstalling the packages to add IMA signatures to the packages. + By default, IMA sigatures will be obtained from the RPM DB. However the RPM DB may not have the signatures. Dectect this case by checking if there are >reinstall_threshold package missing IMA signatures. + EOF exit 1 } @@ -28,6 +33,9 @@ for _opt in "$@"; do exit 1 fi ;; + --reinstall_threshold=*) + reinstall_threshold=${_opt#*=} + ;; *) usage ;; From 62f613cbb7e1753b2e8fa0ce547c02be24842b22 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 3 Jun 2024 14:39:06 +0800 Subject: [PATCH 30/56] ima-setup: include the integrity module for the default kernel ima-setup may run after a new kernel is installed. Detect this case by checking if the default kernel is the running kernel. Suggested-by: Marko Myllynen Signed-off-by: Coiby Xu --- ima-setup.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ima-setup.sh b/ima-setup.sh index 34dd33d..403ca12 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -118,6 +118,15 @@ if ! lsinitrd --mod | grep -q integrity; then cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module" dracut -f + + if command -v grubby >/dev/null; then + _default_kernel=$(grubby --default-kernel | sed -En "s/.*vmlinuz-(.*)/\1/p") + if [[ $_default_kernel != $(uname -r) ]]; then + echo "Current kernel is no the default kernel ($_default_kernel), include dracut integrity for it as well" + dracut -f --kver "$_default_kernel" + fi + fi + fi if ! load_ima_policy "$ima_policy_path"; then From 99360adddc2ae3e3b0f868d0d64b512b2ffee12a Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 6 Jun 2024 18:20:24 +0800 Subject: [PATCH 31/56] Release 1.5-5 Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index a57cd78..2bcbcef 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.5 -Release: 4%{?dist} +Release: 5%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-only AND GPL-2.0-only WITH cryptsetup-OpenSSL-exception AND GPL-2.0-or-later WITH Linux-syscall-note Url: http://linux-ima.sourceforge.net/ @@ -139,6 +139,10 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Jun 06 2024 Coiby Xu - 1.5-5 +- add ima-evm-utils-libs subpackage (rpm-sign-libs can depend on ima-evm-utils-libs instead) +- add some IMA setup tools + * Wed Jan 24 2024 Fedora Release Engineering - 1.5-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 495b87670745074a2f2e4f289dfa3d013850744e Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 4 Jul 2024 15:02:01 +0100 Subject: [PATCH 32/56] Bootstrap 1.6, update licenses, spec updates --- 0001-Add-copies-of-the-license-text.patch | 894 ++++++++++++++++++ ...-for-when-openssl-engine-is-disabled.patch | 49 + ima-evm-utils.spec | 37 +- sources | 2 +- 4 files changed, 969 insertions(+), 13 deletions(-) create mode 100644 0001-Add-copies-of-the-license-text.patch create mode 100644 0001-build-fixes-for-when-openssl-engine-is-disabled.patch diff --git a/0001-Add-copies-of-the-license-text.patch b/0001-Add-copies-of-the-license-text.patch new file mode 100644 index 0000000..cf94430 --- /dev/null +++ b/0001-Add-copies-of-the-license-text.patch @@ -0,0 +1,894 @@ +From a81a03ab75c5cd412006b89bdae5025093ad4081 Mon Sep 17 00:00:00 2001 +From: Peter Robinson +Date: Thu, 4 Jul 2024 14:23:50 +0100 +Subject: [PATCH] Add copies of the license text + +Add copies of the license texts so they're distributed in +the tar files for offline viewing. The text files were +retrieved from: + +https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt +https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt + +Signed-off-by: Peter Robinson +--- + COPYING | 339 +++++++++++++++++++++++++++++++++ + COPYING.LESSER | 502 +++++++++++++++++++++++++++++++++++++++++++++++++ + LICENSES.txt | 4 + + 3 files changed, 845 insertions(+) + create mode 100644 COPYING + create mode 100644 COPYING.LESSER + +diff --git a/COPYING b/COPYING +new file mode 100644 +index 0000000..d159169 +--- /dev/null ++++ b/COPYING +@@ -0,0 +1,339 @@ ++ GNU GENERAL PUBLIC LICENSE ++ Version 2, June 1991 ++ ++ Copyright (C) 1989, 1991 Free Software Foundation, Inc., ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Everyone is permitted to copy and distribute verbatim copies ++ of this license document, but changing it is not allowed. ++ ++ Preamble ++ ++ The licenses for most software are designed to take away your ++freedom to share and change it. By contrast, the GNU General Public ++License is intended to guarantee your freedom to share and change free ++software--to make sure the software is free for all its users. This ++General Public License applies to most of the Free Software ++Foundation's software and to any other program whose authors commit to ++using it. (Some other Free Software Foundation software is covered by ++the GNU Lesser General Public License instead.) You can apply it to ++your programs, too. ++ ++ When we speak of free software, we are referring to freedom, not ++price. Our General Public Licenses are designed to make sure that you ++have the freedom to distribute copies of free software (and charge for ++this service if you wish), that you receive source code or can get it ++if you want it, that you can change the software or use pieces of it ++in new free programs; and that you know you can do these things. ++ ++ To protect your rights, we need to make restrictions that forbid ++anyone to deny you these rights or to ask you to surrender the rights. ++These restrictions translate to certain responsibilities for you if you ++distribute copies of the software, or if you modify it. ++ ++ For example, if you distribute copies of such a program, whether ++gratis or for a fee, you must give the recipients all the rights that ++you have. You must make sure that they, too, receive or can get the ++source code. And you must show them these terms so they know their ++rights. ++ ++ We protect your rights with two steps: (1) copyright the software, and ++(2) offer you this license which gives you legal permission to copy, ++distribute and/or modify the software. ++ ++ Also, for each author's protection and ours, we want to make certain ++that everyone understands that there is no warranty for this free ++software. If the software is modified by someone else and passed on, we ++want its recipients to know that what they have is not the original, so ++that any problems introduced by others will not reflect on the original ++authors' reputations. ++ ++ Finally, any free program is threatened constantly by software ++patents. We wish to avoid the danger that redistributors of a free ++program will individually obtain patent licenses, in effect making the ++program proprietary. To prevent this, we have made it clear that any ++patent must be licensed for everyone's free use or not licensed at all. ++ ++ The precise terms and conditions for copying, distribution and ++modification follow. ++ ++ GNU GENERAL PUBLIC LICENSE ++ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION ++ ++ 0. This License applies to any program or other work which contains ++a notice placed by the copyright holder saying it may be distributed ++under the terms of this General Public License. The "Program", below, ++refers to any such program or work, and a "work based on the Program" ++means either the Program or any derivative work under copyright law: ++that is to say, a work containing the Program or a portion of it, ++either verbatim or with modifications and/or translated into another ++language. (Hereinafter, translation is included without limitation in ++the term "modification".) Each licensee is addressed as "you". ++ ++Activities other than copying, distribution and modification are not ++covered by this License; they are outside its scope. The act of ++running the Program is not restricted, and the output from the Program ++is covered only if its contents constitute a work based on the ++Program (independent of having been made by running the Program). ++Whether that is true depends on what the Program does. ++ ++ 1. You may copy and distribute verbatim copies of the Program's ++source code as you receive it, in any medium, provided that you ++conspicuously and appropriately publish on each copy an appropriate ++copyright notice and disclaimer of warranty; keep intact all the ++notices that refer to this License and to the absence of any warranty; ++and give any other recipients of the Program a copy of this License ++along with the Program. ++ ++You may charge a fee for the physical act of transferring a copy, and ++you may at your option offer warranty protection in exchange for a fee. ++ ++ 2. You may modify your copy or copies of the Program or any portion ++of it, thus forming a work based on the Program, and copy and ++distribute such modifications or work under the terms of Section 1 ++above, provided that you also meet all of these conditions: ++ ++ a) You must cause the modified files to carry prominent notices ++ stating that you changed the files and the date of any change. ++ ++ b) You must cause any work that you distribute or publish, that in ++ whole or in part contains or is derived from the Program or any ++ part thereof, to be licensed as a whole at no charge to all third ++ parties under the terms of this License. ++ ++ c) If the modified program normally reads commands interactively ++ when run, you must cause it, when started running for such ++ interactive use in the most ordinary way, to print or display an ++ announcement including an appropriate copyright notice and a ++ notice that there is no warranty (or else, saying that you provide ++ a warranty) and that users may redistribute the program under ++ these conditions, and telling the user how to view a copy of this ++ License. (Exception: if the Program itself is interactive but ++ does not normally print such an announcement, your work based on ++ the Program is not required to print an announcement.) ++ ++These requirements apply to the modified work as a whole. If ++identifiable sections of that work are not derived from the Program, ++and can be reasonably considered independent and separate works in ++themselves, then this License, and its terms, do not apply to those ++sections when you distribute them as separate works. But when you ++distribute the same sections as part of a whole which is a work based ++on the Program, the distribution of the whole must be on the terms of ++this License, whose permissions for other licensees extend to the ++entire whole, and thus to each and every part regardless of who wrote it. ++ ++Thus, it is not the intent of this section to claim rights or contest ++your rights to work written entirely by you; rather, the intent is to ++exercise the right to control the distribution of derivative or ++collective works based on the Program. ++ ++In addition, mere aggregation of another work not based on the Program ++with the Program (or with a work based on the Program) on a volume of ++a storage or distribution medium does not bring the other work under ++the scope of this License. ++ ++ 3. You may copy and distribute the Program (or a work based on it, ++under Section 2) in object code or executable form under the terms of ++Sections 1 and 2 above provided that you also do one of the following: ++ ++ a) Accompany it with the complete corresponding machine-readable ++ source code, which must be distributed under the terms of Sections ++ 1 and 2 above on a medium customarily used for software interchange; or, ++ ++ b) Accompany it with a written offer, valid for at least three ++ years, to give any third party, for a charge no more than your ++ cost of physically performing source distribution, a complete ++ machine-readable copy of the corresponding source code, to be ++ distributed under the terms of Sections 1 and 2 above on a medium ++ customarily used for software interchange; or, ++ ++ c) Accompany it with the information you received as to the offer ++ to distribute corresponding source code. (This alternative is ++ allowed only for noncommercial distribution and only if you ++ received the program in object code or executable form with such ++ an offer, in accord with Subsection b above.) ++ ++The source code for a work means the preferred form of the work for ++making modifications to it. For an executable work, complete source ++code means all the source code for all modules it contains, plus any ++associated interface definition files, plus the scripts used to ++control compilation and installation of the executable. However, as a ++special exception, the source code distributed need not include ++anything that is normally distributed (in either source or binary ++form) with the major components (compiler, kernel, and so on) of the ++operating system on which the executable runs, unless that component ++itself accompanies the executable. ++ ++If distribution of executable or object code is made by offering ++access to copy from a designated place, then offering equivalent ++access to copy the source code from the same place counts as ++distribution of the source code, even though third parties are not ++compelled to copy the source along with the object code. ++ ++ 4. You may not copy, modify, sublicense, or distribute the Program ++except as expressly provided under this License. Any attempt ++otherwise to copy, modify, sublicense or distribute the Program is ++void, and will automatically terminate your rights under this License. ++However, parties who have received copies, or rights, from you under ++this License will not have their licenses terminated so long as such ++parties remain in full compliance. ++ ++ 5. You are not required to accept this License, since you have not ++signed it. However, nothing else grants you permission to modify or ++distribute the Program or its derivative works. These actions are ++prohibited by law if you do not accept this License. Therefore, by ++modifying or distributing the Program (or any work based on the ++Program), you indicate your acceptance of this License to do so, and ++all its terms and conditions for copying, distributing or modifying ++the Program or works based on it. ++ ++ 6. Each time you redistribute the Program (or any work based on the ++Program), the recipient automatically receives a license from the ++original licensor to copy, distribute or modify the Program subject to ++these terms and conditions. You may not impose any further ++restrictions on the recipients' exercise of the rights granted herein. ++You are not responsible for enforcing compliance by third parties to ++this License. ++ ++ 7. If, as a consequence of a court judgment or allegation of patent ++infringement or for any other reason (not limited to patent issues), ++conditions are imposed on you (whether by court order, agreement or ++otherwise) that contradict the conditions of this License, they do not ++excuse you from the conditions of this License. If you cannot ++distribute so as to satisfy simultaneously your obligations under this ++License and any other pertinent obligations, then as a consequence you ++may not distribute the Program at all. For example, if a patent ++license would not permit royalty-free redistribution of the Program by ++all those who receive copies directly or indirectly through you, then ++the only way you could satisfy both it and this License would be to ++refrain entirely from distribution of the Program. ++ ++If any portion of this section is held invalid or unenforceable under ++any particular circumstance, the balance of the section is intended to ++apply and the section as a whole is intended to apply in other ++circumstances. ++ ++It is not the purpose of this section to induce you to infringe any ++patents or other property right claims or to contest validity of any ++such claims; this section has the sole purpose of protecting the ++integrity of the free software distribution system, which is ++implemented by public license practices. Many people have made ++generous contributions to the wide range of software distributed ++through that system in reliance on consistent application of that ++system; it is up to the author/donor to decide if he or she is willing ++to distribute software through any other system and a licensee cannot ++impose that choice. ++ ++This section is intended to make thoroughly clear what is believed to ++be a consequence of the rest of this License. ++ ++ 8. If the distribution and/or use of the Program is restricted in ++certain countries either by patents or by copyrighted interfaces, the ++original copyright holder who places the Program under this License ++may add an explicit geographical distribution limitation excluding ++those countries, so that distribution is permitted only in or among ++countries not thus excluded. In such case, this License incorporates ++the limitation as if written in the body of this License. ++ ++ 9. The Free Software Foundation may publish revised and/or new versions ++of the General Public License from time to time. Such new versions will ++be similar in spirit to the present version, but may differ in detail to ++address new problems or concerns. ++ ++Each version is given a distinguishing version number. If the Program ++specifies a version number of this License which applies to it and "any ++later version", you have the option of following the terms and conditions ++either of that version or of any later version published by the Free ++Software Foundation. If the Program does not specify a version number of ++this License, you may choose any version ever published by the Free Software ++Foundation. ++ ++ 10. If you wish to incorporate parts of the Program into other free ++programs whose distribution conditions are different, write to the author ++to ask for permission. For software which is copyrighted by the Free ++Software Foundation, write to the Free Software Foundation; we sometimes ++make exceptions for this. Our decision will be guided by the two goals ++of preserving the free status of all derivatives of our free software and ++of promoting the sharing and reuse of software generally. ++ ++ NO WARRANTY ++ ++ 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY ++FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN ++OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES ++PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED ++OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF ++MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS ++TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE ++PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, ++REPAIR OR CORRECTION. ++ ++ 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING ++WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR ++REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, ++INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING ++OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED ++TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY ++YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER ++PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE ++POSSIBILITY OF SUCH DAMAGES. ++ ++ END OF TERMS AND CONDITIONS ++ ++ How to Apply These Terms to Your New Programs ++ ++ If you develop a new program, and you want it to be of the greatest ++possible use to the public, the best way to achieve this is to make it ++free software which everyone can redistribute and change under these terms. ++ ++ To do so, attach the following notices to the program. It is safest ++to attach them to the start of each source file to most effectively ++convey the exclusion of warranty; and each file should have at least ++the "copyright" line and a pointer to where the full notice is found. ++ ++ ++ Copyright (C) ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 2 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License along ++ with this program; if not, write to the Free Software Foundation, Inc., ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++ ++Also add information on how to contact you by electronic and paper mail. ++ ++If the program is interactive, make it output a short notice like this ++when it starts in an interactive mode: ++ ++ Gnomovision version 69, Copyright (C) year name of author ++ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. ++ This is free software, and you are welcome to redistribute it ++ under certain conditions; type `show c' for details. ++ ++The hypothetical commands `show w' and `show c' should show the appropriate ++parts of the General Public License. Of course, the commands you use may ++be called something other than `show w' and `show c'; they could even be ++mouse-clicks or menu items--whatever suits your program. ++ ++You should also get your employer (if you work as a programmer) or your ++school, if any, to sign a "copyright disclaimer" for the program, if ++necessary. Here is a sample; alter the names: ++ ++ Yoyodyne, Inc., hereby disclaims all copyright interest in the program ++ `Gnomovision' (which makes passes at compilers) written by James Hacker. ++ ++ , 1 April 1989 ++ Ty Coon, President of Vice ++ ++This General Public License does not permit incorporating your program into ++proprietary programs. If your program is a subroutine library, you may ++consider it more useful to permit linking proprietary applications with the ++library. If this is what you want to do, use the GNU Lesser General ++Public License instead of this License. +diff --git a/COPYING.LESSER b/COPYING.LESSER +new file mode 100644 +index 0000000..4362b49 +--- /dev/null ++++ b/COPYING.LESSER +@@ -0,0 +1,502 @@ ++ GNU LESSER GENERAL PUBLIC LICENSE ++ Version 2.1, February 1999 ++ ++ Copyright (C) 1991, 1999 Free Software Foundation, Inc. ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Everyone is permitted to copy and distribute verbatim copies ++ of this license document, but changing it is not allowed. ++ ++[This is the first released version of the Lesser GPL. It also counts ++ as the successor of the GNU Library Public License, version 2, hence ++ the version number 2.1.] ++ ++ Preamble ++ ++ The licenses for most software are designed to take away your ++freedom to share and change it. By contrast, the GNU General Public ++Licenses are intended to guarantee your freedom to share and change ++free software--to make sure the software is free for all its users. ++ ++ This license, the Lesser General Public License, applies to some ++specially designated software packages--typically libraries--of the ++Free Software Foundation and other authors who decide to use it. You ++can use it too, but we suggest you first think carefully about whether ++this license or the ordinary General Public License is the better ++strategy to use in any particular case, based on the explanations below. ++ ++ When we speak of free software, we are referring to freedom of use, ++not price. Our General Public Licenses are designed to make sure that ++you have the freedom to distribute copies of free software (and charge ++for this service if you wish); that you receive source code or can get ++it if you want it; that you can change the software and use pieces of ++it in new free programs; and that you are informed that you can do ++these things. ++ ++ To protect your rights, we need to make restrictions that forbid ++distributors to deny you these rights or to ask you to surrender these ++rights. These restrictions translate to certain responsibilities for ++you if you distribute copies of the library or if you modify it. ++ ++ For example, if you distribute copies of the library, whether gratis ++or for a fee, you must give the recipients all the rights that we gave ++you. You must make sure that they, too, receive or can get the source ++code. If you link other code with the library, you must provide ++complete object files to the recipients, so that they can relink them ++with the library after making changes to the library and recompiling ++it. And you must show them these terms so they know their rights. ++ ++ We protect your rights with a two-step method: (1) we copyright the ++library, and (2) we offer you this license, which gives you legal ++permission to copy, distribute and/or modify the library. ++ ++ To protect each distributor, we want to make it very clear that ++there is no warranty for the free library. Also, if the library is ++modified by someone else and passed on, the recipients should know ++that what they have is not the original version, so that the original ++author's reputation will not be affected by problems that might be ++introduced by others. ++ ++ Finally, software patents pose a constant threat to the existence of ++any free program. We wish to make sure that a company cannot ++effectively restrict the users of a free program by obtaining a ++restrictive license from a patent holder. Therefore, we insist that ++any patent license obtained for a version of the library must be ++consistent with the full freedom of use specified in this license. ++ ++ Most GNU software, including some libraries, is covered by the ++ordinary GNU General Public License. This license, the GNU Lesser ++General Public License, applies to certain designated libraries, and ++is quite different from the ordinary General Public License. We use ++this license for certain libraries in order to permit linking those ++libraries into non-free programs. ++ ++ When a program is linked with a library, whether statically or using ++a shared library, the combination of the two is legally speaking a ++combined work, a derivative of the original library. The ordinary ++General Public License therefore permits such linking only if the ++entire combination fits its criteria of freedom. The Lesser General ++Public License permits more lax criteria for linking other code with ++the library. ++ ++ We call this license the "Lesser" General Public License because it ++does Less to protect the user's freedom than the ordinary General ++Public License. It also provides other free software developers Less ++of an advantage over competing non-free programs. These disadvantages ++are the reason we use the ordinary General Public License for many ++libraries. However, the Lesser license provides advantages in certain ++special circumstances. ++ ++ For example, on rare occasions, there may be a special need to ++encourage the widest possible use of a certain library, so that it becomes ++a de-facto standard. To achieve this, non-free programs must be ++allowed to use the library. A more frequent case is that a free ++library does the same job as widely used non-free libraries. In this ++case, there is little to gain by limiting the free library to free ++software only, so we use the Lesser General Public License. ++ ++ In other cases, permission to use a particular library in non-free ++programs enables a greater number of people to use a large body of ++free software. For example, permission to use the GNU C Library in ++non-free programs enables many more people to use the whole GNU ++operating system, as well as its variant, the GNU/Linux operating ++system. ++ ++ Although the Lesser General Public License is Less protective of the ++users' freedom, it does ensure that the user of a program that is ++linked with the Library has the freedom and the wherewithal to run ++that program using a modified version of the Library. ++ ++ The precise terms and conditions for copying, distribution and ++modification follow. Pay close attention to the difference between a ++"work based on the library" and a "work that uses the library". The ++former contains code derived from the library, whereas the latter must ++be combined with the library in order to run. ++ ++ GNU LESSER GENERAL PUBLIC LICENSE ++ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION ++ ++ 0. This License Agreement applies to any software library or other ++program which contains a notice placed by the copyright holder or ++other authorized party saying it may be distributed under the terms of ++this Lesser General Public License (also called "this License"). ++Each licensee is addressed as "you". ++ ++ A "library" means a collection of software functions and/or data ++prepared so as to be conveniently linked with application programs ++(which use some of those functions and data) to form executables. ++ ++ The "Library", below, refers to any such software library or work ++which has been distributed under these terms. A "work based on the ++Library" means either the Library or any derivative work under ++copyright law: that is to say, a work containing the Library or a ++portion of it, either verbatim or with modifications and/or translated ++straightforwardly into another language. (Hereinafter, translation is ++included without limitation in the term "modification".) ++ ++ "Source code" for a work means the preferred form of the work for ++making modifications to it. For a library, complete source code means ++all the source code for all modules it contains, plus any associated ++interface definition files, plus the scripts used to control compilation ++and installation of the library. ++ ++ Activities other than copying, distribution and modification are not ++covered by this License; they are outside its scope. The act of ++running a program using the Library is not restricted, and output from ++such a program is covered only if its contents constitute a work based ++on the Library (independent of the use of the Library in a tool for ++writing it). Whether that is true depends on what the Library does ++and what the program that uses the Library does. ++ ++ 1. You may copy and distribute verbatim copies of the Library's ++complete source code as you receive it, in any medium, provided that ++you conspicuously and appropriately publish on each copy an ++appropriate copyright notice and disclaimer of warranty; keep intact ++all the notices that refer to this License and to the absence of any ++warranty; and distribute a copy of this License along with the ++Library. ++ ++ You may charge a fee for the physical act of transferring a copy, ++and you may at your option offer warranty protection in exchange for a ++fee. ++ ++ 2. You may modify your copy or copies of the Library or any portion ++of it, thus forming a work based on the Library, and copy and ++distribute such modifications or work under the terms of Section 1 ++above, provided that you also meet all of these conditions: ++ ++ a) The modified work must itself be a software library. ++ ++ b) You must cause the files modified to carry prominent notices ++ stating that you changed the files and the date of any change. ++ ++ c) You must cause the whole of the work to be licensed at no ++ charge to all third parties under the terms of this License. ++ ++ d) If a facility in the modified Library refers to a function or a ++ table of data to be supplied by an application program that uses ++ the facility, other than as an argument passed when the facility ++ is invoked, then you must make a good faith effort to ensure that, ++ in the event an application does not supply such function or ++ table, the facility still operates, and performs whatever part of ++ its purpose remains meaningful. ++ ++ (For example, a function in a library to compute square roots has ++ a purpose that is entirely well-defined independent of the ++ application. Therefore, Subsection 2d requires that any ++ application-supplied function or table used by this function must ++ be optional: if the application does not supply it, the square ++ root function must still compute square roots.) ++ ++These requirements apply to the modified work as a whole. If ++identifiable sections of that work are not derived from the Library, ++and can be reasonably considered independent and separate works in ++themselves, then this License, and its terms, do not apply to those ++sections when you distribute them as separate works. But when you ++distribute the same sections as part of a whole which is a work based ++on the Library, the distribution of the whole must be on the terms of ++this License, whose permissions for other licensees extend to the ++entire whole, and thus to each and every part regardless of who wrote ++it. ++ ++Thus, it is not the intent of this section to claim rights or contest ++your rights to work written entirely by you; rather, the intent is to ++exercise the right to control the distribution of derivative or ++collective works based on the Library. ++ ++In addition, mere aggregation of another work not based on the Library ++with the Library (or with a work based on the Library) on a volume of ++a storage or distribution medium does not bring the other work under ++the scope of this License. ++ ++ 3. You may opt to apply the terms of the ordinary GNU General Public ++License instead of this License to a given copy of the Library. To do ++this, you must alter all the notices that refer to this License, so ++that they refer to the ordinary GNU General Public License, version 2, ++instead of to this License. (If a newer version than version 2 of the ++ordinary GNU General Public License has appeared, then you can specify ++that version instead if you wish.) Do not make any other change in ++these notices. ++ ++ Once this change is made in a given copy, it is irreversible for ++that copy, so the ordinary GNU General Public License applies to all ++subsequent copies and derivative works made from that copy. ++ ++ This option is useful when you wish to copy part of the code of ++the Library into a program that is not a library. ++ ++ 4. You may copy and distribute the Library (or a portion or ++derivative of it, under Section 2) in object code or executable form ++under the terms of Sections 1 and 2 above provided that you accompany ++it with the complete corresponding machine-readable source code, which ++must be distributed under the terms of Sections 1 and 2 above on a ++medium customarily used for software interchange. ++ ++ If distribution of object code is made by offering access to copy ++from a designated place, then offering equivalent access to copy the ++source code from the same place satisfies the requirement to ++distribute the source code, even though third parties are not ++compelled to copy the source along with the object code. ++ ++ 5. A program that contains no derivative of any portion of the ++Library, but is designed to work with the Library by being compiled or ++linked with it, is called a "work that uses the Library". Such a ++work, in isolation, is not a derivative work of the Library, and ++therefore falls outside the scope of this License. ++ ++ However, linking a "work that uses the Library" with the Library ++creates an executable that is a derivative of the Library (because it ++contains portions of the Library), rather than a "work that uses the ++library". The executable is therefore covered by this License. ++Section 6 states terms for distribution of such executables. ++ ++ When a "work that uses the Library" uses material from a header file ++that is part of the Library, the object code for the work may be a ++derivative work of the Library even though the source code is not. ++Whether this is true is especially significant if the work can be ++linked without the Library, or if the work is itself a library. The ++threshold for this to be true is not precisely defined by law. ++ ++ If such an object file uses only numerical parameters, data ++structure layouts and accessors, and small macros and small inline ++functions (ten lines or less in length), then the use of the object ++file is unrestricted, regardless of whether it is legally a derivative ++work. (Executables containing this object code plus portions of the ++Library will still fall under Section 6.) ++ ++ Otherwise, if the work is a derivative of the Library, you may ++distribute the object code for the work under the terms of Section 6. ++Any executables containing that work also fall under Section 6, ++whether or not they are linked directly with the Library itself. ++ ++ 6. As an exception to the Sections above, you may also combine or ++link a "work that uses the Library" with the Library to produce a ++work containing portions of the Library, and distribute that work ++under terms of your choice, provided that the terms permit ++modification of the work for the customer's own use and reverse ++engineering for debugging such modifications. ++ ++ You must give prominent notice with each copy of the work that the ++Library is used in it and that the Library and its use are covered by ++this License. You must supply a copy of this License. If the work ++during execution displays copyright notices, you must include the ++copyright notice for the Library among them, as well as a reference ++directing the user to the copy of this License. Also, you must do one ++of these things: ++ ++ a) Accompany the work with the complete corresponding ++ machine-readable source code for the Library including whatever ++ changes were used in the work (which must be distributed under ++ Sections 1 and 2 above); and, if the work is an executable linked ++ with the Library, with the complete machine-readable "work that ++ uses the Library", as object code and/or source code, so that the ++ user can modify the Library and then relink to produce a modified ++ executable containing the modified Library. (It is understood ++ that the user who changes the contents of definitions files in the ++ Library will not necessarily be able to recompile the application ++ to use the modified definitions.) ++ ++ b) Use a suitable shared library mechanism for linking with the ++ Library. A suitable mechanism is one that (1) uses at run time a ++ copy of the library already present on the user's computer system, ++ rather than copying library functions into the executable, and (2) ++ will operate properly with a modified version of the library, if ++ the user installs one, as long as the modified version is ++ interface-compatible with the version that the work was made with. ++ ++ c) Accompany the work with a written offer, valid for at ++ least three years, to give the same user the materials ++ specified in Subsection 6a, above, for a charge no more ++ than the cost of performing this distribution. ++ ++ d) If distribution of the work is made by offering access to copy ++ from a designated place, offer equivalent access to copy the above ++ specified materials from the same place. ++ ++ e) Verify that the user has already received a copy of these ++ materials or that you have already sent this user a copy. ++ ++ For an executable, the required form of the "work that uses the ++Library" must include any data and utility programs needed for ++reproducing the executable from it. However, as a special exception, ++the materials to be distributed need not include anything that is ++normally distributed (in either source or binary form) with the major ++components (compiler, kernel, and so on) of the operating system on ++which the executable runs, unless that component itself accompanies ++the executable. ++ ++ It may happen that this requirement contradicts the license ++restrictions of other proprietary libraries that do not normally ++accompany the operating system. Such a contradiction means you cannot ++use both them and the Library together in an executable that you ++distribute. ++ ++ 7. You may place library facilities that are a work based on the ++Library side-by-side in a single library together with other library ++facilities not covered by this License, and distribute such a combined ++library, provided that the separate distribution of the work based on ++the Library and of the other library facilities is otherwise ++permitted, and provided that you do these two things: ++ ++ a) Accompany the combined library with a copy of the same work ++ based on the Library, uncombined with any other library ++ facilities. This must be distributed under the terms of the ++ Sections above. ++ ++ b) Give prominent notice with the combined library of the fact ++ that part of it is a work based on the Library, and explaining ++ where to find the accompanying uncombined form of the same work. ++ ++ 8. You may not copy, modify, sublicense, link with, or distribute ++the Library except as expressly provided under this License. Any ++attempt otherwise to copy, modify, sublicense, link with, or ++distribute the Library is void, and will automatically terminate your ++rights under this License. However, parties who have received copies, ++or rights, from you under this License will not have their licenses ++terminated so long as such parties remain in full compliance. ++ ++ 9. You are not required to accept this License, since you have not ++signed it. However, nothing else grants you permission to modify or ++distribute the Library or its derivative works. These actions are ++prohibited by law if you do not accept this License. Therefore, by ++modifying or distributing the Library (or any work based on the ++Library), you indicate your acceptance of this License to do so, and ++all its terms and conditions for copying, distributing or modifying ++the Library or works based on it. ++ ++ 10. Each time you redistribute the Library (or any work based on the ++Library), the recipient automatically receives a license from the ++original licensor to copy, distribute, link with or modify the Library ++subject to these terms and conditions. You may not impose any further ++restrictions on the recipients' exercise of the rights granted herein. ++You are not responsible for enforcing compliance by third parties with ++this License. ++ ++ 11. If, as a consequence of a court judgment or allegation of patent ++infringement or for any other reason (not limited to patent issues), ++conditions are imposed on you (whether by court order, agreement or ++otherwise) that contradict the conditions of this License, they do not ++excuse you from the conditions of this License. If you cannot ++distribute so as to satisfy simultaneously your obligations under this ++License and any other pertinent obligations, then as a consequence you ++may not distribute the Library at all. For example, if a patent ++license would not permit royalty-free redistribution of the Library by ++all those who receive copies directly or indirectly through you, then ++the only way you could satisfy both it and this License would be to ++refrain entirely from distribution of the Library. ++ ++If any portion of this section is held invalid or unenforceable under any ++particular circumstance, the balance of the section is intended to apply, ++and the section as a whole is intended to apply in other circumstances. ++ ++It is not the purpose of this section to induce you to infringe any ++patents or other property right claims or to contest validity of any ++such claims; this section has the sole purpose of protecting the ++integrity of the free software distribution system which is ++implemented by public license practices. Many people have made ++generous contributions to the wide range of software distributed ++through that system in reliance on consistent application of that ++system; it is up to the author/donor to decide if he or she is willing ++to distribute software through any other system and a licensee cannot ++impose that choice. ++ ++This section is intended to make thoroughly clear what is believed to ++be a consequence of the rest of this License. ++ ++ 12. If the distribution and/or use of the Library is restricted in ++certain countries either by patents or by copyrighted interfaces, the ++original copyright holder who places the Library under this License may add ++an explicit geographical distribution limitation excluding those countries, ++so that distribution is permitted only in or among countries not thus ++excluded. In such case, this License incorporates the limitation as if ++written in the body of this License. ++ ++ 13. The Free Software Foundation may publish revised and/or new ++versions of the Lesser General Public License from time to time. ++Such new versions will be similar in spirit to the present version, ++but may differ in detail to address new problems or concerns. ++ ++Each version is given a distinguishing version number. If the Library ++specifies a version number of this License which applies to it and ++"any later version", you have the option of following the terms and ++conditions either of that version or of any later version published by ++the Free Software Foundation. If the Library does not specify a ++license version number, you may choose any version ever published by ++the Free Software Foundation. ++ ++ 14. If you wish to incorporate parts of the Library into other free ++programs whose distribution conditions are incompatible with these, ++write to the author to ask for permission. For software which is ++copyrighted by the Free Software Foundation, write to the Free ++Software Foundation; we sometimes make exceptions for this. Our ++decision will be guided by the two goals of preserving the free status ++of all derivatives of our free software and of promoting the sharing ++and reuse of software generally. ++ ++ NO WARRANTY ++ ++ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO ++WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. ++EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR ++OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY ++KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE ++IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ++PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE ++LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME ++THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. ++ ++ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN ++WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY ++AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU ++FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR ++CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE ++LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING ++RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A ++FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF ++SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH ++DAMAGES. ++ ++ END OF TERMS AND CONDITIONS ++ ++ How to Apply These Terms to Your New Libraries ++ ++ If you develop a new library, and you want it to be of the greatest ++possible use to the public, we recommend making it free software that ++everyone can redistribute and change. You can do so by permitting ++redistribution under these terms (or, alternatively, under the terms of the ++ordinary General Public License). ++ ++ To apply these terms, attach the following notices to the library. It is ++safest to attach them to the start of each source file to most effectively ++convey the exclusion of warranty; and each file should have at least the ++"copyright" line and a pointer to where the full notice is found. ++ ++ ++ Copyright (C) ++ ++ This library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ This library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with this library; if not, write to the Free Software ++ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ ++Also add information on how to contact you by electronic and paper mail. ++ ++You should also get your employer (if you work as a programmer) or your ++school, if any, to sign a "copyright disclaimer" for the library, if ++necessary. Here is a sample; alter the names: ++ ++ Yoyodyne, Inc., hereby disclaims all copyright interest in the ++ library `Frob' (a library for tweaking knobs) written by James Random Hacker. ++ ++ , 1 April 1990 ++ Ty Coon, President of Vice ++ ++That's all there is to it! +diff --git a/LICENSES.txt b/LICENSES.txt +index 1477ba9..a1369e7 100644 +--- a/LICENSES.txt ++++ b/LICENSES.txt +@@ -6,8 +6,12 @@ libimaevm is provided under: + + https://spdx.org/licenses/LGPL-2.0-or-later.html + ++ See COPYING.LESSER ++ + evmctl is provided under: + + SPDX-License-Identifier: GPL-2.0-or-later + + https://spdx.org/licenses/GPL-2.0-or-later.html ++ ++ See COPYING +-- +2.45.2 + diff --git a/0001-build-fixes-for-when-openssl-engine-is-disabled.patch b/0001-build-fixes-for-when-openssl-engine-is-disabled.patch new file mode 100644 index 0000000..9252dee --- /dev/null +++ b/0001-build-fixes-for-when-openssl-engine-is-disabled.patch @@ -0,0 +1,49 @@ +From 57c2de595967affdabf8c477f81470d3c2ec04f2 Mon Sep 17 00:00:00 2001 +From: Peter Robinson +Date: Thu, 4 Jul 2024 13:47:45 +0100 +Subject: [PATCH] build fixes for when openssl engine is disabled + +Add and fix checks for building with the option for +disabling the openssl engine option. In cases now +it's possible that engine.h now actually may not be +present as distros may split out the engine support +into other devel packages. This fixes the builds. + +Signed-off-by: Peter Robinson +--- + src/imaevm.h | 4 ++-- + src/libimaevm.c | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/imaevm.h b/src/imaevm.h +index e646b18..a5fd591 100644 +--- a/src/imaevm.h ++++ b/src/imaevm.h +@@ -27,8 +27,8 @@ + #include + #include + +-#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) +-# include ++#if CONFIG_IMA_EVM_ENGINE ++#include + #else + struct engine_st; + typedef struct engine_st ENGINE; /* unused when no engine support */ +diff --git a/src/libimaevm.c b/src/libimaevm.c +index 6321f10..9c8e286 100644 +--- a/src/libimaevm.c ++++ b/src/libimaevm.c +@@ -37,7 +37,9 @@ + #include + #include + #include ++#if CONFIG_IMA_EVM_ENGINE + #include ++#endif + + #if CONFIG_IMA_EVM_PROVIDER + #include +-- +2.45.2 + diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 2bcbcef..85667c8 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,17 +1,18 @@ # If the soname gets bumped we need to ship a compat library to be able # to bootstrap and rebuild rpm else we end up with chicken and egg problem. -%global bootstrap 0 +%global bootstrap 1 %if 0%{bootstrap} -%global compat_soversion 3 +%global compat_soversion 4 %endif Name: ima-evm-utils -Version: 1.5 -Release: 5%{?dist} +Version: 1.6 +Release: 0%{?dist} Summary: IMA/EVM support utilities -License: GPL-2.0-only AND GPL-2.0-only WITH cryptsetup-OpenSSL-exception AND GPL-2.0-or-later WITH Linux-syscall-note +License: GPL-2.0-or-later Url: http://linux-ima.sourceforge.net/ + Source0: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz # IMA setup tools @@ -22,9 +23,15 @@ Source100: policy-01-appraise-exectuables-and-lib-signatures Source101: policy-02-keylime-remote-attestation Source200: policy_list +# https://github.com/linux-integrity/ima-evm-utils/pull/7 +Patch0: 0001-Add-copies-of-the-license-text.patch +# https://github.com/linux-integrity/ima-evm-utils/pull/6 +Patch1: 0001-build-fixes-for-when-openssl-engine-is-disabled.patch + %if 0%{bootstrap} # compat source and patches -Source10: ima-evm-utils-1.4.tar.gz +Source10: ima-evm-utils-1.5.tar.gz +BuildRequires: openssl-devel-engine %endif BuildRequires: asciidoc @@ -52,6 +59,7 @@ ima-evm-utils is used to prepare the file system for these extended attributes. %package libs Summary: Libraries for %{name} +License: LGPL-2.0-or-later %description libs This package contains the libraries for applications to use @@ -59,13 +67,14 @@ ima-evm-utils functionality. %package devel Summary: Development files for %{name} +Requires: %{name} = %{version}-%{release} Requires: %{name}-libs = %{version}-%{release} %description devel This package provides the header files for %{name} %prep -%setup -q +%autosetup -p1 %if 0%{bootstrap} mkdir compat/ @@ -113,7 +122,7 @@ install -D %{SOURCE3} $RPM_BUILD_ROOT%{_bindir}/ima-add-sigs install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %files -%license COPYING +%license LICENSES.txt COPYING %doc NEWS README AUTHORS %{_bindir}/evmctl %{_mandir}/man1/evmctl* @@ -124,13 +133,12 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_bindir}/ima-add-sigs %{_bindir}/ima-setup - %files libs +%license LICENSES.txt COPYING.LESSER # if you need to bump the soname version, coordinate with dependent packages -%{_libdir}/libimaevm.so.4* +%{_libdir}/libimaevm.so.5* %if 0%{bootstrap} -%{_libdir}/libimaevm.so.%{compat_soversion} -%{_libdir}/libimaevm.so.%{compat_soversion}.0.0 +%{_libdir}/libimaevm.so.%{compat_soversion}* %endif %files devel @@ -139,6 +147,11 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Wed Jul 03 2024 Peter Robinson - 1.6-0 +- Bootstrap 1.6 +- Update license for new details +- Spec file updates + * Thu Jun 06 2024 Coiby Xu - 1.5-5 - add ima-evm-utils-libs subpackage (rpm-sign-libs can depend on ima-evm-utils-libs instead) - add some IMA setup tools diff --git a/sources b/sources index 5c19b08..c0897e9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 SHA512 (ima-evm-utils-1.5.tar.gz) = a1f0f2441dd1c41044f1b9a2151c53a02ed539dc1317950c4f8d72ec6340b2ac464bd572e6b0971bc2fe5dcc1842013f5698fe1bf2de92524ae0891c24daa417 +SHA512 (ima-evm-utils-1.6.tar.gz) = 1c7360e42cb7eb1578bb6d9804386165852ef4dc6f2b47362fc38e2cd6789e52508e25ec046fadeb7d13dce472ed3a32e1ba66a525a049182edd9b558f578b4e From c7007efe32f0086782b39f2774d4172ad08f17e4 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 4 Jul 2024 15:24:13 +0100 Subject: [PATCH 33/56] Update to 1.6 post bootstrap --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 85667c8..4b069bf 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -1,6 +1,6 @@ # If the soname gets bumped we need to ship a compat library to be able # to bootstrap and rebuild rpm else we end up with chicken and egg problem. -%global bootstrap 1 +%global bootstrap 0 %if 0%{bootstrap} %global compat_soversion 4 @@ -147,6 +147,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Jul 04 2024 Peter Robinson - 1.6-1 +- Update to 1.6 + * Wed Jul 03 2024 Peter Robinson - 1.6-0 - Bootstrap 1.6 - Update license for new details From eac85666d34bb9910cf6045fff355d531899fdab Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 5 Jul 2024 13:30:10 +0100 Subject: [PATCH 34/56] bump release --- ima-evm-utils.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 4b069bf..cff2804 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6 -Release: 0%{?dist} +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: http://linux-ima.sourceforge.net/ From 15e23a0944b8a1b61681effd9a94020999861ac2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:17:23 +0000 Subject: [PATCH 35/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index cff2804..340c74a 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: http://linux-ima.sourceforge.net/ @@ -147,6 +147,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Thu Jul 04 2024 Peter Robinson - 1.6-1 - Update to 1.6 From 01077eea3fdbf242ec44643ffd48a05d247c4ef1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 29 Aug 2024 10:55:31 +0100 Subject: [PATCH 36/56] 1.6.1 --- 0001-Add-copies-of-the-license-text.patch | 894 ------------------ ...-for-when-openssl-engine-is-disabled.patch | 49 - ima-evm-utils.spec | 20 +- sources | 3 +- 4 files changed, 10 insertions(+), 956 deletions(-) delete mode 100644 0001-Add-copies-of-the-license-text.patch delete mode 100644 0001-build-fixes-for-when-openssl-engine-is-disabled.patch diff --git a/0001-Add-copies-of-the-license-text.patch b/0001-Add-copies-of-the-license-text.patch deleted file mode 100644 index cf94430..0000000 --- a/0001-Add-copies-of-the-license-text.patch +++ /dev/null @@ -1,894 +0,0 @@ -From a81a03ab75c5cd412006b89bdae5025093ad4081 Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Thu, 4 Jul 2024 14:23:50 +0100 -Subject: [PATCH] Add copies of the license text - -Add copies of the license texts so they're distributed in -the tar files for offline viewing. The text files were -retrieved from: - -https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt -https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt - -Signed-off-by: Peter Robinson ---- - COPYING | 339 +++++++++++++++++++++++++++++++++ - COPYING.LESSER | 502 +++++++++++++++++++++++++++++++++++++++++++++++++ - LICENSES.txt | 4 + - 3 files changed, 845 insertions(+) - create mode 100644 COPYING - create mode 100644 COPYING.LESSER - -diff --git a/COPYING b/COPYING -new file mode 100644 -index 0000000..d159169 ---- /dev/null -+++ b/COPYING -@@ -0,0 +1,339 @@ -+ GNU GENERAL PUBLIC LICENSE -+ Version 2, June 1991 -+ -+ Copyright (C) 1989, 1991 Free Software Foundation, Inc., -+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -+ Everyone is permitted to copy and distribute verbatim copies -+ of this license document, but changing it is not allowed. -+ -+ Preamble -+ -+ The licenses for most software are designed to take away your -+freedom to share and change it. By contrast, the GNU General Public -+License is intended to guarantee your freedom to share and change free -+software--to make sure the software is free for all its users. This -+General Public License applies to most of the Free Software -+Foundation's software and to any other program whose authors commit to -+using it. (Some other Free Software Foundation software is covered by -+the GNU Lesser General Public License instead.) You can apply it to -+your programs, too. -+ -+ When we speak of free software, we are referring to freedom, not -+price. Our General Public Licenses are designed to make sure that you -+have the freedom to distribute copies of free software (and charge for -+this service if you wish), that you receive source code or can get it -+if you want it, that you can change the software or use pieces of it -+in new free programs; and that you know you can do these things. -+ -+ To protect your rights, we need to make restrictions that forbid -+anyone to deny you these rights or to ask you to surrender the rights. -+These restrictions translate to certain responsibilities for you if you -+distribute copies of the software, or if you modify it. -+ -+ For example, if you distribute copies of such a program, whether -+gratis or for a fee, you must give the recipients all the rights that -+you have. You must make sure that they, too, receive or can get the -+source code. And you must show them these terms so they know their -+rights. -+ -+ We protect your rights with two steps: (1) copyright the software, and -+(2) offer you this license which gives you legal permission to copy, -+distribute and/or modify the software. -+ -+ Also, for each author's protection and ours, we want to make certain -+that everyone understands that there is no warranty for this free -+software. If the software is modified by someone else and passed on, we -+want its recipients to know that what they have is not the original, so -+that any problems introduced by others will not reflect on the original -+authors' reputations. -+ -+ Finally, any free program is threatened constantly by software -+patents. We wish to avoid the danger that redistributors of a free -+program will individually obtain patent licenses, in effect making the -+program proprietary. To prevent this, we have made it clear that any -+patent must be licensed for everyone's free use or not licensed at all. -+ -+ The precise terms and conditions for copying, distribution and -+modification follow. -+ -+ GNU GENERAL PUBLIC LICENSE -+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION -+ -+ 0. This License applies to any program or other work which contains -+a notice placed by the copyright holder saying it may be distributed -+under the terms of this General Public License. The "Program", below, -+refers to any such program or work, and a "work based on the Program" -+means either the Program or any derivative work under copyright law: -+that is to say, a work containing the Program or a portion of it, -+either verbatim or with modifications and/or translated into another -+language. (Hereinafter, translation is included without limitation in -+the term "modification".) Each licensee is addressed as "you". -+ -+Activities other than copying, distribution and modification are not -+covered by this License; they are outside its scope. The act of -+running the Program is not restricted, and the output from the Program -+is covered only if its contents constitute a work based on the -+Program (independent of having been made by running the Program). -+Whether that is true depends on what the Program does. -+ -+ 1. You may copy and distribute verbatim copies of the Program's -+source code as you receive it, in any medium, provided that you -+conspicuously and appropriately publish on each copy an appropriate -+copyright notice and disclaimer of warranty; keep intact all the -+notices that refer to this License and to the absence of any warranty; -+and give any other recipients of the Program a copy of this License -+along with the Program. -+ -+You may charge a fee for the physical act of transferring a copy, and -+you may at your option offer warranty protection in exchange for a fee. -+ -+ 2. You may modify your copy or copies of the Program or any portion -+of it, thus forming a work based on the Program, and copy and -+distribute such modifications or work under the terms of Section 1 -+above, provided that you also meet all of these conditions: -+ -+ a) You must cause the modified files to carry prominent notices -+ stating that you changed the files and the date of any change. -+ -+ b) You must cause any work that you distribute or publish, that in -+ whole or in part contains or is derived from the Program or any -+ part thereof, to be licensed as a whole at no charge to all third -+ parties under the terms of this License. -+ -+ c) If the modified program normally reads commands interactively -+ when run, you must cause it, when started running for such -+ interactive use in the most ordinary way, to print or display an -+ announcement including an appropriate copyright notice and a -+ notice that there is no warranty (or else, saying that you provide -+ a warranty) and that users may redistribute the program under -+ these conditions, and telling the user how to view a copy of this -+ License. (Exception: if the Program itself is interactive but -+ does not normally print such an announcement, your work based on -+ the Program is not required to print an announcement.) -+ -+These requirements apply to the modified work as a whole. If -+identifiable sections of that work are not derived from the Program, -+and can be reasonably considered independent and separate works in -+themselves, then this License, and its terms, do not apply to those -+sections when you distribute them as separate works. But when you -+distribute the same sections as part of a whole which is a work based -+on the Program, the distribution of the whole must be on the terms of -+this License, whose permissions for other licensees extend to the -+entire whole, and thus to each and every part regardless of who wrote it. -+ -+Thus, it is not the intent of this section to claim rights or contest -+your rights to work written entirely by you; rather, the intent is to -+exercise the right to control the distribution of derivative or -+collective works based on the Program. -+ -+In addition, mere aggregation of another work not based on the Program -+with the Program (or with a work based on the Program) on a volume of -+a storage or distribution medium does not bring the other work under -+the scope of this License. -+ -+ 3. You may copy and distribute the Program (or a work based on it, -+under Section 2) in object code or executable form under the terms of -+Sections 1 and 2 above provided that you also do one of the following: -+ -+ a) Accompany it with the complete corresponding machine-readable -+ source code, which must be distributed under the terms of Sections -+ 1 and 2 above on a medium customarily used for software interchange; or, -+ -+ b) Accompany it with a written offer, valid for at least three -+ years, to give any third party, for a charge no more than your -+ cost of physically performing source distribution, a complete -+ machine-readable copy of the corresponding source code, to be -+ distributed under the terms of Sections 1 and 2 above on a medium -+ customarily used for software interchange; or, -+ -+ c) Accompany it with the information you received as to the offer -+ to distribute corresponding source code. (This alternative is -+ allowed only for noncommercial distribution and only if you -+ received the program in object code or executable form with such -+ an offer, in accord with Subsection b above.) -+ -+The source code for a work means the preferred form of the work for -+making modifications to it. For an executable work, complete source -+code means all the source code for all modules it contains, plus any -+associated interface definition files, plus the scripts used to -+control compilation and installation of the executable. However, as a -+special exception, the source code distributed need not include -+anything that is normally distributed (in either source or binary -+form) with the major components (compiler, kernel, and so on) of the -+operating system on which the executable runs, unless that component -+itself accompanies the executable. -+ -+If distribution of executable or object code is made by offering -+access to copy from a designated place, then offering equivalent -+access to copy the source code from the same place counts as -+distribution of the source code, even though third parties are not -+compelled to copy the source along with the object code. -+ -+ 4. You may not copy, modify, sublicense, or distribute the Program -+except as expressly provided under this License. Any attempt -+otherwise to copy, modify, sublicense or distribute the Program is -+void, and will automatically terminate your rights under this License. -+However, parties who have received copies, or rights, from you under -+this License will not have their licenses terminated so long as such -+parties remain in full compliance. -+ -+ 5. You are not required to accept this License, since you have not -+signed it. However, nothing else grants you permission to modify or -+distribute the Program or its derivative works. These actions are -+prohibited by law if you do not accept this License. Therefore, by -+modifying or distributing the Program (or any work based on the -+Program), you indicate your acceptance of this License to do so, and -+all its terms and conditions for copying, distributing or modifying -+the Program or works based on it. -+ -+ 6. Each time you redistribute the Program (or any work based on the -+Program), the recipient automatically receives a license from the -+original licensor to copy, distribute or modify the Program subject to -+these terms and conditions. You may not impose any further -+restrictions on the recipients' exercise of the rights granted herein. -+You are not responsible for enforcing compliance by third parties to -+this License. -+ -+ 7. If, as a consequence of a court judgment or allegation of patent -+infringement or for any other reason (not limited to patent issues), -+conditions are imposed on you (whether by court order, agreement or -+otherwise) that contradict the conditions of this License, they do not -+excuse you from the conditions of this License. If you cannot -+distribute so as to satisfy simultaneously your obligations under this -+License and any other pertinent obligations, then as a consequence you -+may not distribute the Program at all. For example, if a patent -+license would not permit royalty-free redistribution of the Program by -+all those who receive copies directly or indirectly through you, then -+the only way you could satisfy both it and this License would be to -+refrain entirely from distribution of the Program. -+ -+If any portion of this section is held invalid or unenforceable under -+any particular circumstance, the balance of the section is intended to -+apply and the section as a whole is intended to apply in other -+circumstances. -+ -+It is not the purpose of this section to induce you to infringe any -+patents or other property right claims or to contest validity of any -+such claims; this section has the sole purpose of protecting the -+integrity of the free software distribution system, which is -+implemented by public license practices. Many people have made -+generous contributions to the wide range of software distributed -+through that system in reliance on consistent application of that -+system; it is up to the author/donor to decide if he or she is willing -+to distribute software through any other system and a licensee cannot -+impose that choice. -+ -+This section is intended to make thoroughly clear what is believed to -+be a consequence of the rest of this License. -+ -+ 8. If the distribution and/or use of the Program is restricted in -+certain countries either by patents or by copyrighted interfaces, the -+original copyright holder who places the Program under this License -+may add an explicit geographical distribution limitation excluding -+those countries, so that distribution is permitted only in or among -+countries not thus excluded. In such case, this License incorporates -+the limitation as if written in the body of this License. -+ -+ 9. The Free Software Foundation may publish revised and/or new versions -+of the General Public License from time to time. Such new versions will -+be similar in spirit to the present version, but may differ in detail to -+address new problems or concerns. -+ -+Each version is given a distinguishing version number. If the Program -+specifies a version number of this License which applies to it and "any -+later version", you have the option of following the terms and conditions -+either of that version or of any later version published by the Free -+Software Foundation. If the Program does not specify a version number of -+this License, you may choose any version ever published by the Free Software -+Foundation. -+ -+ 10. If you wish to incorporate parts of the Program into other free -+programs whose distribution conditions are different, write to the author -+to ask for permission. For software which is copyrighted by the Free -+Software Foundation, write to the Free Software Foundation; we sometimes -+make exceptions for this. Our decision will be guided by the two goals -+of preserving the free status of all derivatives of our free software and -+of promoting the sharing and reuse of software generally. -+ -+ NO WARRANTY -+ -+ 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -+REPAIR OR CORRECTION. -+ -+ 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -+POSSIBILITY OF SUCH DAMAGES. -+ -+ END OF TERMS AND CONDITIONS -+ -+ How to Apply These Terms to Your New Programs -+ -+ If you develop a new program, and you want it to be of the greatest -+possible use to the public, the best way to achieve this is to make it -+free software which everyone can redistribute and change under these terms. -+ -+ To do so, attach the following notices to the program. It is safest -+to attach them to the start of each source file to most effectively -+convey the exclusion of warranty; and each file should have at least -+the "copyright" line and a pointer to where the full notice is found. -+ -+ -+ Copyright (C) -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 2 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License along -+ with this program; if not, write to the Free Software Foundation, Inc., -+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -+ -+Also add information on how to contact you by electronic and paper mail. -+ -+If the program is interactive, make it output a short notice like this -+when it starts in an interactive mode: -+ -+ Gnomovision version 69, Copyright (C) year name of author -+ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. -+ This is free software, and you are welcome to redistribute it -+ under certain conditions; type `show c' for details. -+ -+The hypothetical commands `show w' and `show c' should show the appropriate -+parts of the General Public License. Of course, the commands you use may -+be called something other than `show w' and `show c'; they could even be -+mouse-clicks or menu items--whatever suits your program. -+ -+You should also get your employer (if you work as a programmer) or your -+school, if any, to sign a "copyright disclaimer" for the program, if -+necessary. Here is a sample; alter the names: -+ -+ Yoyodyne, Inc., hereby disclaims all copyright interest in the program -+ `Gnomovision' (which makes passes at compilers) written by James Hacker. -+ -+ , 1 April 1989 -+ Ty Coon, President of Vice -+ -+This General Public License does not permit incorporating your program into -+proprietary programs. If your program is a subroutine library, you may -+consider it more useful to permit linking proprietary applications with the -+library. If this is what you want to do, use the GNU Lesser General -+Public License instead of this License. -diff --git a/COPYING.LESSER b/COPYING.LESSER -new file mode 100644 -index 0000000..4362b49 ---- /dev/null -+++ b/COPYING.LESSER -@@ -0,0 +1,502 @@ -+ GNU LESSER GENERAL PUBLIC LICENSE -+ Version 2.1, February 1999 -+ -+ Copyright (C) 1991, 1999 Free Software Foundation, Inc. -+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -+ Everyone is permitted to copy and distribute verbatim copies -+ of this license document, but changing it is not allowed. -+ -+[This is the first released version of the Lesser GPL. It also counts -+ as the successor of the GNU Library Public License, version 2, hence -+ the version number 2.1.] -+ -+ Preamble -+ -+ The licenses for most software are designed to take away your -+freedom to share and change it. By contrast, the GNU General Public -+Licenses are intended to guarantee your freedom to share and change -+free software--to make sure the software is free for all its users. -+ -+ This license, the Lesser General Public License, applies to some -+specially designated software packages--typically libraries--of the -+Free Software Foundation and other authors who decide to use it. You -+can use it too, but we suggest you first think carefully about whether -+this license or the ordinary General Public License is the better -+strategy to use in any particular case, based on the explanations below. -+ -+ When we speak of free software, we are referring to freedom of use, -+not price. Our General Public Licenses are designed to make sure that -+you have the freedom to distribute copies of free software (and charge -+for this service if you wish); that you receive source code or can get -+it if you want it; that you can change the software and use pieces of -+it in new free programs; and that you are informed that you can do -+these things. -+ -+ To protect your rights, we need to make restrictions that forbid -+distributors to deny you these rights or to ask you to surrender these -+rights. These restrictions translate to certain responsibilities for -+you if you distribute copies of the library or if you modify it. -+ -+ For example, if you distribute copies of the library, whether gratis -+or for a fee, you must give the recipients all the rights that we gave -+you. You must make sure that they, too, receive or can get the source -+code. If you link other code with the library, you must provide -+complete object files to the recipients, so that they can relink them -+with the library after making changes to the library and recompiling -+it. And you must show them these terms so they know their rights. -+ -+ We protect your rights with a two-step method: (1) we copyright the -+library, and (2) we offer you this license, which gives you legal -+permission to copy, distribute and/or modify the library. -+ -+ To protect each distributor, we want to make it very clear that -+there is no warranty for the free library. Also, if the library is -+modified by someone else and passed on, the recipients should know -+that what they have is not the original version, so that the original -+author's reputation will not be affected by problems that might be -+introduced by others. -+ -+ Finally, software patents pose a constant threat to the existence of -+any free program. We wish to make sure that a company cannot -+effectively restrict the users of a free program by obtaining a -+restrictive license from a patent holder. Therefore, we insist that -+any patent license obtained for a version of the library must be -+consistent with the full freedom of use specified in this license. -+ -+ Most GNU software, including some libraries, is covered by the -+ordinary GNU General Public License. This license, the GNU Lesser -+General Public License, applies to certain designated libraries, and -+is quite different from the ordinary General Public License. We use -+this license for certain libraries in order to permit linking those -+libraries into non-free programs. -+ -+ When a program is linked with a library, whether statically or using -+a shared library, the combination of the two is legally speaking a -+combined work, a derivative of the original library. The ordinary -+General Public License therefore permits such linking only if the -+entire combination fits its criteria of freedom. The Lesser General -+Public License permits more lax criteria for linking other code with -+the library. -+ -+ We call this license the "Lesser" General Public License because it -+does Less to protect the user's freedom than the ordinary General -+Public License. It also provides other free software developers Less -+of an advantage over competing non-free programs. These disadvantages -+are the reason we use the ordinary General Public License for many -+libraries. However, the Lesser license provides advantages in certain -+special circumstances. -+ -+ For example, on rare occasions, there may be a special need to -+encourage the widest possible use of a certain library, so that it becomes -+a de-facto standard. To achieve this, non-free programs must be -+allowed to use the library. A more frequent case is that a free -+library does the same job as widely used non-free libraries. In this -+case, there is little to gain by limiting the free library to free -+software only, so we use the Lesser General Public License. -+ -+ In other cases, permission to use a particular library in non-free -+programs enables a greater number of people to use a large body of -+free software. For example, permission to use the GNU C Library in -+non-free programs enables many more people to use the whole GNU -+operating system, as well as its variant, the GNU/Linux operating -+system. -+ -+ Although the Lesser General Public License is Less protective of the -+users' freedom, it does ensure that the user of a program that is -+linked with the Library has the freedom and the wherewithal to run -+that program using a modified version of the Library. -+ -+ The precise terms and conditions for copying, distribution and -+modification follow. Pay close attention to the difference between a -+"work based on the library" and a "work that uses the library". The -+former contains code derived from the library, whereas the latter must -+be combined with the library in order to run. -+ -+ GNU LESSER GENERAL PUBLIC LICENSE -+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION -+ -+ 0. This License Agreement applies to any software library or other -+program which contains a notice placed by the copyright holder or -+other authorized party saying it may be distributed under the terms of -+this Lesser General Public License (also called "this License"). -+Each licensee is addressed as "you". -+ -+ A "library" means a collection of software functions and/or data -+prepared so as to be conveniently linked with application programs -+(which use some of those functions and data) to form executables. -+ -+ The "Library", below, refers to any such software library or work -+which has been distributed under these terms. A "work based on the -+Library" means either the Library or any derivative work under -+copyright law: that is to say, a work containing the Library or a -+portion of it, either verbatim or with modifications and/or translated -+straightforwardly into another language. (Hereinafter, translation is -+included without limitation in the term "modification".) -+ -+ "Source code" for a work means the preferred form of the work for -+making modifications to it. For a library, complete source code means -+all the source code for all modules it contains, plus any associated -+interface definition files, plus the scripts used to control compilation -+and installation of the library. -+ -+ Activities other than copying, distribution and modification are not -+covered by this License; they are outside its scope. The act of -+running a program using the Library is not restricted, and output from -+such a program is covered only if its contents constitute a work based -+on the Library (independent of the use of the Library in a tool for -+writing it). Whether that is true depends on what the Library does -+and what the program that uses the Library does. -+ -+ 1. You may copy and distribute verbatim copies of the Library's -+complete source code as you receive it, in any medium, provided that -+you conspicuously and appropriately publish on each copy an -+appropriate copyright notice and disclaimer of warranty; keep intact -+all the notices that refer to this License and to the absence of any -+warranty; and distribute a copy of this License along with the -+Library. -+ -+ You may charge a fee for the physical act of transferring a copy, -+and you may at your option offer warranty protection in exchange for a -+fee. -+ -+ 2. You may modify your copy or copies of the Library or any portion -+of it, thus forming a work based on the Library, and copy and -+distribute such modifications or work under the terms of Section 1 -+above, provided that you also meet all of these conditions: -+ -+ a) The modified work must itself be a software library. -+ -+ b) You must cause the files modified to carry prominent notices -+ stating that you changed the files and the date of any change. -+ -+ c) You must cause the whole of the work to be licensed at no -+ charge to all third parties under the terms of this License. -+ -+ d) If a facility in the modified Library refers to a function or a -+ table of data to be supplied by an application program that uses -+ the facility, other than as an argument passed when the facility -+ is invoked, then you must make a good faith effort to ensure that, -+ in the event an application does not supply such function or -+ table, the facility still operates, and performs whatever part of -+ its purpose remains meaningful. -+ -+ (For example, a function in a library to compute square roots has -+ a purpose that is entirely well-defined independent of the -+ application. Therefore, Subsection 2d requires that any -+ application-supplied function or table used by this function must -+ be optional: if the application does not supply it, the square -+ root function must still compute square roots.) -+ -+These requirements apply to the modified work as a whole. If -+identifiable sections of that work are not derived from the Library, -+and can be reasonably considered independent and separate works in -+themselves, then this License, and its terms, do not apply to those -+sections when you distribute them as separate works. But when you -+distribute the same sections as part of a whole which is a work based -+on the Library, the distribution of the whole must be on the terms of -+this License, whose permissions for other licensees extend to the -+entire whole, and thus to each and every part regardless of who wrote -+it. -+ -+Thus, it is not the intent of this section to claim rights or contest -+your rights to work written entirely by you; rather, the intent is to -+exercise the right to control the distribution of derivative or -+collective works based on the Library. -+ -+In addition, mere aggregation of another work not based on the Library -+with the Library (or with a work based on the Library) on a volume of -+a storage or distribution medium does not bring the other work under -+the scope of this License. -+ -+ 3. You may opt to apply the terms of the ordinary GNU General Public -+License instead of this License to a given copy of the Library. To do -+this, you must alter all the notices that refer to this License, so -+that they refer to the ordinary GNU General Public License, version 2, -+instead of to this License. (If a newer version than version 2 of the -+ordinary GNU General Public License has appeared, then you can specify -+that version instead if you wish.) Do not make any other change in -+these notices. -+ -+ Once this change is made in a given copy, it is irreversible for -+that copy, so the ordinary GNU General Public License applies to all -+subsequent copies and derivative works made from that copy. -+ -+ This option is useful when you wish to copy part of the code of -+the Library into a program that is not a library. -+ -+ 4. You may copy and distribute the Library (or a portion or -+derivative of it, under Section 2) in object code or executable form -+under the terms of Sections 1 and 2 above provided that you accompany -+it with the complete corresponding machine-readable source code, which -+must be distributed under the terms of Sections 1 and 2 above on a -+medium customarily used for software interchange. -+ -+ If distribution of object code is made by offering access to copy -+from a designated place, then offering equivalent access to copy the -+source code from the same place satisfies the requirement to -+distribute the source code, even though third parties are not -+compelled to copy the source along with the object code. -+ -+ 5. A program that contains no derivative of any portion of the -+Library, but is designed to work with the Library by being compiled or -+linked with it, is called a "work that uses the Library". Such a -+work, in isolation, is not a derivative work of the Library, and -+therefore falls outside the scope of this License. -+ -+ However, linking a "work that uses the Library" with the Library -+creates an executable that is a derivative of the Library (because it -+contains portions of the Library), rather than a "work that uses the -+library". The executable is therefore covered by this License. -+Section 6 states terms for distribution of such executables. -+ -+ When a "work that uses the Library" uses material from a header file -+that is part of the Library, the object code for the work may be a -+derivative work of the Library even though the source code is not. -+Whether this is true is especially significant if the work can be -+linked without the Library, or if the work is itself a library. The -+threshold for this to be true is not precisely defined by law. -+ -+ If such an object file uses only numerical parameters, data -+structure layouts and accessors, and small macros and small inline -+functions (ten lines or less in length), then the use of the object -+file is unrestricted, regardless of whether it is legally a derivative -+work. (Executables containing this object code plus portions of the -+Library will still fall under Section 6.) -+ -+ Otherwise, if the work is a derivative of the Library, you may -+distribute the object code for the work under the terms of Section 6. -+Any executables containing that work also fall under Section 6, -+whether or not they are linked directly with the Library itself. -+ -+ 6. As an exception to the Sections above, you may also combine or -+link a "work that uses the Library" with the Library to produce a -+work containing portions of the Library, and distribute that work -+under terms of your choice, provided that the terms permit -+modification of the work for the customer's own use and reverse -+engineering for debugging such modifications. -+ -+ You must give prominent notice with each copy of the work that the -+Library is used in it and that the Library and its use are covered by -+this License. You must supply a copy of this License. If the work -+during execution displays copyright notices, you must include the -+copyright notice for the Library among them, as well as a reference -+directing the user to the copy of this License. Also, you must do one -+of these things: -+ -+ a) Accompany the work with the complete corresponding -+ machine-readable source code for the Library including whatever -+ changes were used in the work (which must be distributed under -+ Sections 1 and 2 above); and, if the work is an executable linked -+ with the Library, with the complete machine-readable "work that -+ uses the Library", as object code and/or source code, so that the -+ user can modify the Library and then relink to produce a modified -+ executable containing the modified Library. (It is understood -+ that the user who changes the contents of definitions files in the -+ Library will not necessarily be able to recompile the application -+ to use the modified definitions.) -+ -+ b) Use a suitable shared library mechanism for linking with the -+ Library. A suitable mechanism is one that (1) uses at run time a -+ copy of the library already present on the user's computer system, -+ rather than copying library functions into the executable, and (2) -+ will operate properly with a modified version of the library, if -+ the user installs one, as long as the modified version is -+ interface-compatible with the version that the work was made with. -+ -+ c) Accompany the work with a written offer, valid for at -+ least three years, to give the same user the materials -+ specified in Subsection 6a, above, for a charge no more -+ than the cost of performing this distribution. -+ -+ d) If distribution of the work is made by offering access to copy -+ from a designated place, offer equivalent access to copy the above -+ specified materials from the same place. -+ -+ e) Verify that the user has already received a copy of these -+ materials or that you have already sent this user a copy. -+ -+ For an executable, the required form of the "work that uses the -+Library" must include any data and utility programs needed for -+reproducing the executable from it. However, as a special exception, -+the materials to be distributed need not include anything that is -+normally distributed (in either source or binary form) with the major -+components (compiler, kernel, and so on) of the operating system on -+which the executable runs, unless that component itself accompanies -+the executable. -+ -+ It may happen that this requirement contradicts the license -+restrictions of other proprietary libraries that do not normally -+accompany the operating system. Such a contradiction means you cannot -+use both them and the Library together in an executable that you -+distribute. -+ -+ 7. You may place library facilities that are a work based on the -+Library side-by-side in a single library together with other library -+facilities not covered by this License, and distribute such a combined -+library, provided that the separate distribution of the work based on -+the Library and of the other library facilities is otherwise -+permitted, and provided that you do these two things: -+ -+ a) Accompany the combined library with a copy of the same work -+ based on the Library, uncombined with any other library -+ facilities. This must be distributed under the terms of the -+ Sections above. -+ -+ b) Give prominent notice with the combined library of the fact -+ that part of it is a work based on the Library, and explaining -+ where to find the accompanying uncombined form of the same work. -+ -+ 8. You may not copy, modify, sublicense, link with, or distribute -+the Library except as expressly provided under this License. Any -+attempt otherwise to copy, modify, sublicense, link with, or -+distribute the Library is void, and will automatically terminate your -+rights under this License. However, parties who have received copies, -+or rights, from you under this License will not have their licenses -+terminated so long as such parties remain in full compliance. -+ -+ 9. You are not required to accept this License, since you have not -+signed it. However, nothing else grants you permission to modify or -+distribute the Library or its derivative works. These actions are -+prohibited by law if you do not accept this License. Therefore, by -+modifying or distributing the Library (or any work based on the -+Library), you indicate your acceptance of this License to do so, and -+all its terms and conditions for copying, distributing or modifying -+the Library or works based on it. -+ -+ 10. Each time you redistribute the Library (or any work based on the -+Library), the recipient automatically receives a license from the -+original licensor to copy, distribute, link with or modify the Library -+subject to these terms and conditions. You may not impose any further -+restrictions on the recipients' exercise of the rights granted herein. -+You are not responsible for enforcing compliance by third parties with -+this License. -+ -+ 11. If, as a consequence of a court judgment or allegation of patent -+infringement or for any other reason (not limited to patent issues), -+conditions are imposed on you (whether by court order, agreement or -+otherwise) that contradict the conditions of this License, they do not -+excuse you from the conditions of this License. If you cannot -+distribute so as to satisfy simultaneously your obligations under this -+License and any other pertinent obligations, then as a consequence you -+may not distribute the Library at all. For example, if a patent -+license would not permit royalty-free redistribution of the Library by -+all those who receive copies directly or indirectly through you, then -+the only way you could satisfy both it and this License would be to -+refrain entirely from distribution of the Library. -+ -+If any portion of this section is held invalid or unenforceable under any -+particular circumstance, the balance of the section is intended to apply, -+and the section as a whole is intended to apply in other circumstances. -+ -+It is not the purpose of this section to induce you to infringe any -+patents or other property right claims or to contest validity of any -+such claims; this section has the sole purpose of protecting the -+integrity of the free software distribution system which is -+implemented by public license practices. Many people have made -+generous contributions to the wide range of software distributed -+through that system in reliance on consistent application of that -+system; it is up to the author/donor to decide if he or she is willing -+to distribute software through any other system and a licensee cannot -+impose that choice. -+ -+This section is intended to make thoroughly clear what is believed to -+be a consequence of the rest of this License. -+ -+ 12. If the distribution and/or use of the Library is restricted in -+certain countries either by patents or by copyrighted interfaces, the -+original copyright holder who places the Library under this License may add -+an explicit geographical distribution limitation excluding those countries, -+so that distribution is permitted only in or among countries not thus -+excluded. In such case, this License incorporates the limitation as if -+written in the body of this License. -+ -+ 13. The Free Software Foundation may publish revised and/or new -+versions of the Lesser General Public License from time to time. -+Such new versions will be similar in spirit to the present version, -+but may differ in detail to address new problems or concerns. -+ -+Each version is given a distinguishing version number. If the Library -+specifies a version number of this License which applies to it and -+"any later version", you have the option of following the terms and -+conditions either of that version or of any later version published by -+the Free Software Foundation. If the Library does not specify a -+license version number, you may choose any version ever published by -+the Free Software Foundation. -+ -+ 14. If you wish to incorporate parts of the Library into other free -+programs whose distribution conditions are incompatible with these, -+write to the author to ask for permission. For software which is -+copyrighted by the Free Software Foundation, write to the Free -+Software Foundation; we sometimes make exceptions for this. Our -+decision will be guided by the two goals of preserving the free status -+of all derivatives of our free software and of promoting the sharing -+and reuse of software generally. -+ -+ NO WARRANTY -+ -+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO -+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. -+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR -+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY -+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE -+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE -+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME -+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. -+ -+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN -+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY -+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU -+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR -+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE -+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING -+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A -+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF -+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH -+DAMAGES. -+ -+ END OF TERMS AND CONDITIONS -+ -+ How to Apply These Terms to Your New Libraries -+ -+ If you develop a new library, and you want it to be of the greatest -+possible use to the public, we recommend making it free software that -+everyone can redistribute and change. You can do so by permitting -+redistribution under these terms (or, alternatively, under the terms of the -+ordinary General Public License). -+ -+ To apply these terms, attach the following notices to the library. It is -+safest to attach them to the start of each source file to most effectively -+convey the exclusion of warranty; and each file should have at least the -+"copyright" line and a pointer to where the full notice is found. -+ -+ -+ Copyright (C) -+ -+ This library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ This library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with this library; if not, write to the Free Software -+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -+ -+Also add information on how to contact you by electronic and paper mail. -+ -+You should also get your employer (if you work as a programmer) or your -+school, if any, to sign a "copyright disclaimer" for the library, if -+necessary. Here is a sample; alter the names: -+ -+ Yoyodyne, Inc., hereby disclaims all copyright interest in the -+ library `Frob' (a library for tweaking knobs) written by James Random Hacker. -+ -+ , 1 April 1990 -+ Ty Coon, President of Vice -+ -+That's all there is to it! -diff --git a/LICENSES.txt b/LICENSES.txt -index 1477ba9..a1369e7 100644 ---- a/LICENSES.txt -+++ b/LICENSES.txt -@@ -6,8 +6,12 @@ libimaevm is provided under: - - https://spdx.org/licenses/LGPL-2.0-or-later.html - -+ See COPYING.LESSER -+ - evmctl is provided under: - - SPDX-License-Identifier: GPL-2.0-or-later - - https://spdx.org/licenses/GPL-2.0-or-later.html -+ -+ See COPYING --- -2.45.2 - diff --git a/0001-build-fixes-for-when-openssl-engine-is-disabled.patch b/0001-build-fixes-for-when-openssl-engine-is-disabled.patch deleted file mode 100644 index 9252dee..0000000 --- a/0001-build-fixes-for-when-openssl-engine-is-disabled.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 57c2de595967affdabf8c477f81470d3c2ec04f2 Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Thu, 4 Jul 2024 13:47:45 +0100 -Subject: [PATCH] build fixes for when openssl engine is disabled - -Add and fix checks for building with the option for -disabling the openssl engine option. In cases now -it's possible that engine.h now actually may not be -present as distros may split out the engine support -into other devel packages. This fixes the builds. - -Signed-off-by: Peter Robinson ---- - src/imaevm.h | 4 ++-- - src/libimaevm.c | 2 ++ - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/imaevm.h b/src/imaevm.h -index e646b18..a5fd591 100644 ---- a/src/imaevm.h -+++ b/src/imaevm.h -@@ -27,8 +27,8 @@ - #include - #include - --#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) --# include -+#if CONFIG_IMA_EVM_ENGINE -+#include - #else - struct engine_st; - typedef struct engine_st ENGINE; /* unused when no engine support */ -diff --git a/src/libimaevm.c b/src/libimaevm.c -index 6321f10..9c8e286 100644 ---- a/src/libimaevm.c -+++ b/src/libimaevm.c -@@ -37,7 +37,9 @@ - #include - #include - #include -+#if CONFIG_IMA_EVM_ENGINE - #include -+#endif - - #if CONFIG_IMA_EVM_PROVIDER - #include --- -2.45.2 - diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 340c74a..14009ab 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -7,13 +7,12 @@ %endif Name: ima-evm-utils -Version: 1.6 -Release: 2%{?dist} +Version: 1.6.1 +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later -Url: http://linux-ima.sourceforge.net/ - -Source0: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz +Url: https://github.com/linux-integrity/ +Source0: %{url}/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz # IMA setup tools Source2: dracut-98-integrity.conf @@ -23,11 +22,6 @@ Source100: policy-01-appraise-exectuables-and-lib-signatures Source101: policy-02-keylime-remote-attestation Source200: policy_list -# https://github.com/linux-integrity/ima-evm-utils/pull/7 -Patch0: 0001-Add-copies-of-the-license-text.patch -# https://github.com/linux-integrity/ima-evm-utils/pull/6 -Patch1: 0001-build-fixes-for-when-openssl-engine-is-disabled.patch - %if 0%{bootstrap} # compat source and patches Source10: ima-evm-utils-1.5.tar.gz @@ -134,7 +128,7 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_bindir}/ima-setup %files libs -%license LICENSES.txt COPYING.LESSER +%license LICENSES.txt COPYING.LGPL # if you need to bump the soname version, coordinate with dependent packages %{_libdir}/libimaevm.so.5* %if 0%{bootstrap} @@ -147,6 +141,10 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Aug 29 2024 Peter Robinson - 1.6.1-1 +- Update to 1.6.1 +- Update project URLs + * Thu Jul 18 2024 Fedora Release Engineering - 1.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index c0897e9..19af2b3 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (ima-evm-utils-1.5.tar.gz) = a1f0f2441dd1c41044f1b9a2151c53a02ed539dc1317950c4f8d72ec6340b2ac464bd572e6b0971bc2fe5dcc1842013f5698fe1bf2de92524ae0891c24daa417 -SHA512 (ima-evm-utils-1.6.tar.gz) = 1c7360e42cb7eb1578bb6d9804386165852ef4dc6f2b47362fc38e2cd6789e52508e25ec046fadeb7d13dce472ed3a32e1ba66a525a049182edd9b558f578b4e +SHA512 (ima-evm-utils-1.6.1.tar.gz) = 294fc1e09f07b76863099a674f13b946c1c99936b1bd581c6184a23877e51d1eb8efd177559d1b54cf48750800b80da8c8b986543e23bdfe9da29dec237fb0fb From f21f3c21545cda8da8b57cdb7953c0d033790ec4 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 30 Aug 2024 11:26:13 +0100 Subject: [PATCH 37/56] Fix sign_hash when built without openssl engine support (rhbz#2297927) --- ima-evm-utils.spec | 7 ++- rhbz-2297927.patch | 132 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 138 insertions(+), 1 deletion(-) create mode 100644 rhbz-2297927.patch diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 14009ab..7111797 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -28,6 +28,8 @@ Source10: ima-evm-utils-1.5.tar.gz BuildRequires: openssl-devel-engine %endif +Patch1: rhbz-2297927.patch + BuildRequires: asciidoc BuildRequires: autoconf BuildRequires: automake @@ -141,6 +143,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Fri Aug 30 2024 Peter Robinson - 1.6.1-2 +- Fix sign_hash when built without openssl engine support (rhbz#2297927) + * Thu Aug 29 2024 Peter Robinson - 1.6.1-1 - Update to 1.6.1 - Update project URLs diff --git a/rhbz-2297927.patch b/rhbz-2297927.patch new file mode 100644 index 0000000..097d33b --- /dev/null +++ b/rhbz-2297927.patch @@ -0,0 +1,132 @@ +From 1de0722ef50166b9c398578b50c2cf0acc50ae45 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Thu, 29 Aug 2024 14:56:51 -0500 +Subject: [PATCH] Have read_priv_pkey_provider print error if provider not + supported + +When a engine is not support read_priv_pkey_engine will print an error. +Have read_priv_pkey_provider do the same. + +Signed-off-by: Stefan Berger +--- + src/libimaevm.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/libimaevm.c b/src/libimaevm.c +index b172226..b059749 100644 +--- a/src/libimaevm.c ++++ b/src/libimaevm.c +@@ -1060,10 +1060,12 @@ static int ui_get_pin(UI *ui, UI_STRING *uis) + { + return UI_set_result(ui, uis, UI_get0_user_data(ui)); + } ++#endif + + static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, + const char *keypass, uint32_t keyid) + { ++#ifdef CONFIG_IMA_EVM_PROVIDER + UI_METHOD *ui_method = NULL; + OSSL_STORE_INFO *info; + OSSL_STORE_CTX *store; +@@ -1110,8 +1112,11 @@ static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, + err_provider: + output_openssl_errors(); + return NULL; +-} ++#else ++ log_err("OpenSSL \"provider\" support is disabled\n"); ++ return NULL; + #endif ++} + + static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, + const struct imaevm_ossl_access *access_info, +@@ -1131,12 +1136,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, + pkey = read_priv_pkey_engine(access_info->u.engine, + keyfile, keypass, keyid); + break; +-#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: + pkey = read_priv_pkey_provider(access_info->u.provider, + keyfile, keypass, keyid); + break; +-#endif + } + } else { + fp = fopen(keyfile, "r"); +From e43ea9060c8fff49d378da9cdc9e09eeda732349 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Thu, 29 Aug 2024 15:00:44 -0500 +Subject: [PATCH] Have check_ossl_access only check for valid types + +Have check_ossl_access only check for valid types in the type field. +The functions actually using engine or provider will report an error +if engine or provider is not supported. + +Signed-off-by: Stefan Berger +--- + src/libimaevm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/libimaevm.c b/src/libimaevm.c +index b059749..9c74bf9 100644 +--- a/src/libimaevm.c ++++ b/src/libimaevm.c +@@ -1388,16 +1388,16 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, + return len; + } + ++/* ++ * Check whether access_info contains a valid type. Whether the type ++ * (engine or provider) is supported must be checked elsewhere. ++ */ + static int check_ossl_access(const struct imaevm_ossl_access *access_info) + { + switch (access_info->type) { + case IMAEVM_OSSL_ACCESS_TYPE_NONE: +-#ifdef CONFIG_IMA_EVM_ENGINE + case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: +-#endif +-#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: +-#endif + return 0; + + default: +From d15dce22f20babb4707991b83bf724860ff45e01 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Thu, 29 Aug 2024 15:06:08 -0500 +Subject: [PATCH] Only pass access_info to imaevm_signhash if an engine is + provided + +Avoid the access_info parameter from being passed to imaevm_signhash +if no engine is provided. + +Signed-off-by: Stefan Berger +--- + src/libimaevm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/libimaevm.c b/src/libimaevm.c +index 9c74bf9..d7ceb4a 100644 +--- a/src/libimaevm.c ++++ b/src/libimaevm.c +@@ -1447,12 +1447,16 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, + .type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE, + .u.engine = imaevm_params.eng, + }; ++ struct imaevm_ossl_access const *paccess_info = NULL; ++ if (imaevm_params.eng) ++ paccess_info = &access_info; ++ + int sigflags = imaevm_params.x509 ? 0 : IMAEVM_SIGFLAG_SIGNATURE_V1; + if (!keypass) /* Avoid breaking existing libimaevm usage */ + keypass = imaevm_params.keypass; + + return imaevm_signhash(hashalgo, hash, size, keyfile, keypass, sig, +- sigflags, &access_info, imaevm_params.keyid); ++ sigflags, paccess_info, imaevm_params.keyid); + } + + static void libinit() From 1da998f418630216e87cb1c6ebaf67ecbb10635c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 31 Aug 2024 10:48:53 +0100 Subject: [PATCH 38/56] Update to 1.6.2 --- ima-evm-utils.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 7111797..e4f75bf 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -7,8 +7,8 @@ %endif Name: ima-evm-utils -Version: 1.6.1 -Release: 2%{?dist} +Version: 1.6.2 +Release: 1%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -143,6 +143,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Sat Aug 31 2024 Peter Robinson - 1.6.2-1 +- Update to 1.6.2 + * Fri Aug 30 2024 Peter Robinson - 1.6.1-2 - Fix sign_hash when built without openssl engine support (rhbz#2297927) diff --git a/sources b/sources index 19af2b3..f312ac6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ima-evm-utils-1.6.1.tar.gz) = 294fc1e09f07b76863099a674f13b946c1c99936b1bd581c6184a23877e51d1eb8efd177559d1b54cf48750800b80da8c8b986543e23bdfe9da29dec237fb0fb +SHA512 (ima-evm-utils-1.6.2.tar.gz) = dfd82ba7c48c14fd31d687214a2b0cfcf269bdea42d4a0ebc872a72205f880c509ed5c5cd55dec7e94444e6f3bdc3c071ec6c2e3eba1e6579edb8ef11aa158a1 From b3f1d7bf0e6113c44b6040afb029c1b17ed3454c Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 31 Aug 2024 10:55:24 +0100 Subject: [PATCH 39/56] drop upstream patch --- ima-evm-utils.spec | 2 - rhbz-2297927.patch | 132 --------------------------------------------- 2 files changed, 134 deletions(-) delete mode 100644 rhbz-2297927.patch diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index e4f75bf..196ecda 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -28,8 +28,6 @@ Source10: ima-evm-utils-1.5.tar.gz BuildRequires: openssl-devel-engine %endif -Patch1: rhbz-2297927.patch - BuildRequires: asciidoc BuildRequires: autoconf BuildRequires: automake diff --git a/rhbz-2297927.patch b/rhbz-2297927.patch deleted file mode 100644 index 097d33b..0000000 --- a/rhbz-2297927.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 1de0722ef50166b9c398578b50c2cf0acc50ae45 Mon Sep 17 00:00:00 2001 -From: Stefan Berger -Date: Thu, 29 Aug 2024 14:56:51 -0500 -Subject: [PATCH] Have read_priv_pkey_provider print error if provider not - supported - -When a engine is not support read_priv_pkey_engine will print an error. -Have read_priv_pkey_provider do the same. - -Signed-off-by: Stefan Berger ---- - src/libimaevm.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/src/libimaevm.c b/src/libimaevm.c -index b172226..b059749 100644 ---- a/src/libimaevm.c -+++ b/src/libimaevm.c -@@ -1060,10 +1060,12 @@ static int ui_get_pin(UI *ui, UI_STRING *uis) - { - return UI_set_result(ui, uis, UI_get0_user_data(ui)); - } -+#endif - - static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, - const char *keypass, uint32_t keyid) - { -+#ifdef CONFIG_IMA_EVM_PROVIDER - UI_METHOD *ui_method = NULL; - OSSL_STORE_INFO *info; - OSSL_STORE_CTX *store; -@@ -1110,8 +1112,11 @@ static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, - err_provider: - output_openssl_errors(); - return NULL; --} -+#else -+ log_err("OpenSSL \"provider\" support is disabled\n"); -+ return NULL; - #endif -+} - - static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, - const struct imaevm_ossl_access *access_info, -@@ -1131,12 +1136,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, - pkey = read_priv_pkey_engine(access_info->u.engine, - keyfile, keypass, keyid); - break; --#ifdef CONFIG_IMA_EVM_PROVIDER - case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: - pkey = read_priv_pkey_provider(access_info->u.provider, - keyfile, keypass, keyid); - break; --#endif - } - } else { - fp = fopen(keyfile, "r"); -From e43ea9060c8fff49d378da9cdc9e09eeda732349 Mon Sep 17 00:00:00 2001 -From: Stefan Berger -Date: Thu, 29 Aug 2024 15:00:44 -0500 -Subject: [PATCH] Have check_ossl_access only check for valid types - -Have check_ossl_access only check for valid types in the type field. -The functions actually using engine or provider will report an error -if engine or provider is not supported. - -Signed-off-by: Stefan Berger ---- - src/libimaevm.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/src/libimaevm.c b/src/libimaevm.c -index b059749..9c74bf9 100644 ---- a/src/libimaevm.c -+++ b/src/libimaevm.c -@@ -1388,16 +1388,16 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, - return len; - } - -+/* -+ * Check whether access_info contains a valid type. Whether the type -+ * (engine or provider) is supported must be checked elsewhere. -+ */ - static int check_ossl_access(const struct imaevm_ossl_access *access_info) - { - switch (access_info->type) { - case IMAEVM_OSSL_ACCESS_TYPE_NONE: --#ifdef CONFIG_IMA_EVM_ENGINE - case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: --#endif --#ifdef CONFIG_IMA_EVM_PROVIDER - case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: --#endif - return 0; - - default: -From d15dce22f20babb4707991b83bf724860ff45e01 Mon Sep 17 00:00:00 2001 -From: Stefan Berger -Date: Thu, 29 Aug 2024 15:06:08 -0500 -Subject: [PATCH] Only pass access_info to imaevm_signhash if an engine is - provided - -Avoid the access_info parameter from being passed to imaevm_signhash -if no engine is provided. - -Signed-off-by: Stefan Berger ---- - src/libimaevm.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/src/libimaevm.c b/src/libimaevm.c -index 9c74bf9..d7ceb4a 100644 ---- a/src/libimaevm.c -+++ b/src/libimaevm.c -@@ -1447,12 +1447,16 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, - .type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE, - .u.engine = imaevm_params.eng, - }; -+ struct imaevm_ossl_access const *paccess_info = NULL; -+ if (imaevm_params.eng) -+ paccess_info = &access_info; -+ - int sigflags = imaevm_params.x509 ? 0 : IMAEVM_SIGFLAG_SIGNATURE_V1; - if (!keypass) /* Avoid breaking existing libimaevm usage */ - keypass = imaevm_params.keypass; - - return imaevm_signhash(hashalgo, hash, size, keyfile, keypass, sig, -- sigflags, &access_info, imaevm_params.keyid); -+ sigflags, paccess_info, imaevm_params.keyid); - } - - static void libinit() From a15c0930ebf8ce842a5171af1f257ef23fb982f9 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Sat, 19 Oct 2024 15:10:34 -0700 Subject: [PATCH 40/56] ima-evm-utils-libs obsoletes ima-evm-utils < 1.6 for rhbz#2319827 This should fix the problem that, on upgrade to Fedora 41, ima-evm-utils is kept installed (even though it's likely no longer needed, only the bits split out into ima-evm-utils-libs) and drags in rpm-plugin-ima as a dependency. We do not want that package installed in typical use cases, it should be opt-in only. --- ima-evm-utils.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 196ecda..8326d2c 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -55,6 +55,10 @@ ima-evm-utils is used to prepare the file system for these extended attributes. Summary: Libraries for %{name} License: LGPL-2.0-or-later +# to avoid ima-evm-utils and rpm-plugin-ima being installed on upgrade +# to Fedora 41 - https://bugzilla.redhat.com/show_bug.cgi?id=2319827 +Obsoletes: ima-evm-utils < 1.6 + %description libs This package contains the libraries for applications to use ima-evm-utils functionality. @@ -141,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Fri Oct 18 2024 Adam Williamson - 1.6.2-2 +- ima-evm-utils-libs obsoletes ima-evm-utils < 1.6 for rhbz#2319827 + * Sat Aug 31 2024 Peter Robinson - 1.6.2-1 - Update to 1.6.2 From 83b610d7edee02804dc1cecab8e151728925e90b Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Wed, 16 Oct 2024 13:48:01 +0800 Subject: [PATCH 41/56] Skip some file systems for appraisal Resolves: https://issues.redhat.com/browse/RHEL-62817 When 01-appraise-exectuables-and-lib-signatures is enabled, no login screen is available for user to log in. This happens because IMA stops gnome-shell from creating some temp files as can been from the audit log, type=INTEGRITY_DATA msg=audit(1728700747.130:10235): pid=3240 uid=42 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 op=appraise_data cause=IMA-signature-required comm="gnome-shell" name="/dev/shm/#3223" dev="tmpfs" ino=3223 res=0 errno=0UID="gdm" AUID="unset" type=INTEGRITY_DATA msg=audit(1728700747.130:10236): pid=3240 uid=42 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 op=appraise_data cause=IMA-signature-required comm="gnome-shell" name="/run/user/42/#454" dev="tmpfs" ino=454 res=0 errno=0UID="gdm" AUID="unset" type=INTEGRITY_DATA msg=audit(1728700747.131:10237): pid=3240 uid=42 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 op=appraise_data cause=IMA-signature-required comm="gnome-shell" name="memfd:libffi" dev="tmpfs" ino=578 res=0 errno=0UID="gdm" AUID="unset" Skip the file systems as listed in https://www.kernel.org/doc/Documentation/ABI/testing/ima_policy Reported-by: Raju Cheerla --- ima-evm-utils.spec | 2 +- ...01-appraise-exectuables-and-lib-signatures | 2 -- ...-01-appraise-executable-and-lib-signatures | 28 +++++++++++++++++++ policy_list | 2 +- 4 files changed, 30 insertions(+), 4 deletions(-) delete mode 100644 policy-01-appraise-exectuables-and-lib-signatures create mode 100644 policy-01-appraise-executable-and-lib-signatures diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 8326d2c..4ad4907 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -18,7 +18,7 @@ Source0: %{url}/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.t Source2: dracut-98-integrity.conf Source3: ima-add-sigs.sh Source4: ima-setup.sh -Source100: policy-01-appraise-exectuables-and-lib-signatures +Source100: policy-01-appraise-executable-and-lib-signatures Source101: policy-02-keylime-remote-attestation Source200: policy_list diff --git a/policy-01-appraise-exectuables-and-lib-signatures b/policy-01-appraise-exectuables-and-lib-signatures deleted file mode 100644 index afc4530..0000000 --- a/policy-01-appraise-exectuables-and-lib-signatures +++ /dev/null @@ -1,2 +0,0 @@ -appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig -appraise func=BPRM_CHECK appraise_type=imasig diff --git a/policy-01-appraise-executable-and-lib-signatures b/policy-01-appraise-executable-and-lib-signatures new file mode 100644 index 0000000..53feed5 --- /dev/null +++ b/policy-01-appraise-executable-and-lib-signatures @@ -0,0 +1,28 @@ +# Skip some unsupported filesystems +# This list of the filesystems can be found on +# https://www.kernel.org/doc/Documentation/ABI/testing/ima_policy +# PROC_SUPER_MAGIC +dont_appraise fsmagic=0x9fa0 +# SYSFS_MAGIC +dont_appraise fsmagic=0x62656572 +# DEBUGFS_MAGIC +dont_appraise fsmagic=0x64626720 +# TMPFS_MAGIC +dont_appraise fsmagic=0x01021994 +# RAMFS_MAGIC +dont_appraise fsmagic=0x858458f6 +# DEVPTS_SUPER_MAGIC +dont_appraise fsmagic=0x1cd1 +# BINFMTFS_MAGIC +dont_appraise fsmagic=0x42494e4d +# SECURITYFS_MAGIC +dont_appraise fsmagic=0x73636673 +# SELINUX_MAGIC +dont_appraise fsmagic=0xf97cff8c +# CGROUP_SUPER_MAGIC +dont_appraise fsmagic=0x27e0eb +# NSFS_MAGIC +dont_appraise fsmagic=0x6e736673 + +appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig +appraise func=BPRM_CHECK appraise_type=imasig diff --git a/policy_list b/policy_list index 23ff71a..af81a74 100644 --- a/policy_list +++ b/policy_list @@ -1,2 +1,2 @@ -01-appraise-exectuables-and-lib-signatures +01-appraise-executable-and-lib-signatures 02-keylime-remote-attestation From 0e28d7448d1ac2608241949a25d6cb245b04874d Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Wed, 16 Oct 2024 14:10:05 +0800 Subject: [PATCH 42/56] add usage for ima-add-sigs Also format the usage info ima-setup. Signed-off-by: Coiby Xu --- ima-add-sigs.sh | 43 +++++++++++++++++++++++++++++-------------- ima-setup.sh | 8 ++++++-- 2 files changed, 35 insertions(+), 16 deletions(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 4321ace..6777d4b 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -1,16 +1,31 @@ #!/bin/bash # # This script add IMA signatures to installed RPM package files -# Usage: add_ima_sigs.sh [--package=PACKAGE_NAME|ALL] [--ima-cert=IMA_CERT_PATH] [--reinstall_threshold=NUM] -# -# By default, it will add IMA sigantures to all installed package files. Or you -# can provide a package name to only add IMA signature for files of specicifed -# package. If it detects >=20 packages (or 1 package if you specify a package -# name) missing signatures in the RPM database, it will reinstall the packages -# in order to get the IMA signatures. -# -# With the signing IMA cert path specified, it will also try to verify -# the added IMA signature. +usage() { + echo "Add IMA signatures to installed packages." + cat <reinstall_threshold (=20 by default) packages in the RPM + DB missing IMA signatures, reinstalling the packages to add IMA + signatures to the packages. By default, IMA sigatures will be obtained + from the RPM DB. However the RPM DB may not have the signatures. Dectect + this case by checking if there are >reinstall_threshold package missing + IMA signatures. + + --ima-cert + With the signing IMA cert path specified, it will also try to verify the + added IMA signature. + +EOF + exit 1 +} for _opt in "$@"; do case "$_opt" in @@ -24,7 +39,7 @@ for _opt in "$@"; do ima_cert=${_opt#*=} ;; *) - usage + [[ -n $1 ]] && usage ;; esac done @@ -41,7 +56,7 @@ abort() { # Add IMA signatures from RPM database add_from_rpm_db() { if ! command -v setfattr &>/dev/null; then - abort "Please install attr" + abort "Please install attr" fi # use "|" as deliminator since it won't be used in a filename or signature @@ -80,7 +95,7 @@ if [[ -z $reinstall_threshold ]]; then if [[ $package == "--all" ]]; then reinstall_threshold=20 else - if ! rpm -q --quiet $package; then + if ! rpm -q --quiet "$package"; then dnf install "$package" -yq >/dev/null exit 0 fi @@ -88,7 +103,7 @@ if [[ -z $reinstall_threshold ]]; then fi fi -unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" $package | grep "^(none)$" | wc -l) +unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep "^(none)$" | wc -l) if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then add_by_reinstall diff --git a/ima-setup.sh b/ima-setup.sh index 403ca12..8e773ad 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -17,8 +17,12 @@ usage: $0 --policy=IMA_POLICY_PATH [--reinstall_threshold=NUM] /usr/share/ima/policies or you can use your own IMA policy --reinstall_threshold - When there are >reinstall_threshold packages in the RPM DB missing IMA signatures, reinstalling the packages to add IMA signatures to the packages. - By default, IMA sigatures will be obtained from the RPM DB. However the RPM DB may not have the signatures. Dectect this case by checking if there are >reinstall_threshold package missing IMA signatures. + When there are >reinstall_threshold packages in the RPM DB missing IMA + signatures, reinstalling the packages to add IMA signatures to the + packages. By default, IMA sigatures will be obtained from the RPM DB. + However the RPM DB may not have the signatures. Dectect this case by + checking if there are >reinstall_threshold package missing IMA + signatures. EOF exit 1 From 083226d5ef3ba9e11e5ea89562c387f1e5bf68af Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 31 Oct 2024 15:02:33 +0800 Subject: [PATCH 43/56] update to 1.6.2-3 --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 4ad4907..621a14c 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Oct 31 2024 Coiby Xu - 1.6.2-3 +- Skip unsupported file systems for sample appraisal rule + * Fri Oct 18 2024 Adam Williamson - 1.6.2-2 - ima-evm-utils-libs obsoletes ima-evm-utils < 1.6 for rhbz#2319827 From e15aa409cdd638889523ce2dbdba10990471ff1a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:03:53 +0000 Subject: [PATCH 44/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 621a14c..f05d7ac 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 1.6.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Thu Oct 31 2024 Coiby Xu - 1.6.2-3 - Skip unsupported file systems for sample appraisal rule From 2f1870b21accb4393a420cf55cba774dfd2d78ae Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Tue, 25 Feb 2025 13:17:28 +0800 Subject: [PATCH 45/56] ima-setup: run zipl after building initramfs for s390x Resovles: https://issues.redhat.com/browse/RHEL-74293 Without running zipl, the old initramfs will be booted. Signed-off-by: Coiby Xu --- ima-setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-setup.sh b/ima-setup.sh index 8e773ad..cf043f5 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -130,7 +130,7 @@ if ! lsinitrd --mod | grep -q integrity; then dracut -f --kver "$_default_kernel" fi fi - + [[ $(uname -m) == s390x ]] && zipl &> /dev/null fi if ! load_ima_policy "$ima_policy_path"; then From 7b800d82d0947fd0e75e92997a3aec7af079c1cc Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Tue, 25 Feb 2025 13:24:33 +0800 Subject: [PATCH 46/56] ima-setup: fix two shellcheck warnings Fix the following two shellcheck warnings, In ima-setup.sh line 36: echo "$policy_file doesn't exist" ^----------^ SC2154 (warning): policy_file is referenced but not assigned. In ima-setup.sh line 41: reinstall_threshold=${_opt#*=} ^-----------------^ SC2034 (warning): reinstall_threshold appears unused. Verify use (or export if used externally). Signed-off-by: Coiby Xu --- ima-setup.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ima-setup.sh b/ima-setup.sh index cf043f5..ad2b595 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -33,7 +33,7 @@ for _opt in "$@"; do --policy=*) ima_policy_path=${_opt#*=} if [[ ! -e $ima_policy_path ]]; then - echo "$policy_file doesn't exist" + echo "$ima_policy_path doesn't exist" exit 1 fi ;; @@ -55,7 +55,7 @@ if test -f /run/ostree-booted; then echo "You are using OSTree, please enable IMA signatures as part of the OSTree creation process." else echo "Adding IMA signatures to installed package files" - if ! ima-add-sigs; then + if ! ima-add-sigs --reinstall_threshold="$reinstall_threshold"; then echo "Failed to add IMA signatures, abort" exit 1 fi From e962d0cac47c3b2fc587f46a2e3547a28ffe526d Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 3 Mar 2025 10:05:13 +0800 Subject: [PATCH 47/56] Use packit to automate ima-evm-utils releasing Follow [1] to use packit to automate releasing ima-evm-utils. After finishing one-time setting up, when there is a new upstream release, here's the new process of releasing a new version in Fedora, 1. https://release-monitoring.org/ finds a new upstream and notify packit 2. packit: automatically create PRs to propose new release for different Fedora releases; also upload new tarballs into lookaside cache. 3. Maintainer: review(, modify) and merge the PR 4. packit: create a koji build 5. packit: create a Bodhi update So maintainers only need to do step 3 manually and all the repetitive work can be left to packit to handle. After the PR gets merged, two more things need to be done [2], - Create a Fedora mapping for the upstream project in https://release-monitoring.org/projects - Set Monitoring status on the left side at https://src.fedoraproject.org/rpms/ima-evm-utils to Monitoring [1] https://packit.dev/docs/fedora-releases-guide/dist-git-onboarding [2] https://packit.dev/docs/fedora-releases-guide/dist-git-onboarding#2-monitoring-of-the-package Signed-off-by: Coiby Xu --- .gitignore | 1 + .packit.yaml | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 .packit.yaml diff --git a/.gitignore b/.gitignore index 2646509..6d559b3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /ima-evm-utils-*.tar.gz +prepare_sources_result*/ diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..3360032 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,34 @@ +# See the documentation for more information: +# https://packit.dev/docs/configuration/ + +specfile_path: ima-evm-util.spec + +# add or remove files that should be synced +files_to_sync: + - .packit.yaml + +# name in upstream package repository or registry (e.g. in PyPI) +upstream_package_name: ima-evm-utils +# downstream (Fedora) RPM package name +downstream_package_name: ima-evm-utils + +jobs: + # This is triggered by https://release-monitoring.org/ + - job: pull_from_upstream + trigger: release + dist_git_branches: + - fedora-all + + # This is triggered at Fedora dist-git for creating koji build after + # PR in src.fedoraproject.org been merged. + - job: koji_build + trigger: commit + allowed_pr_authors: ["all_committers"] + dist_git_branches: + - fedora-all + + # This is triggered at Fedora messaging bus about koji build finished. + - job: bodhi_update + trigger: commit + allowed_builders: ["all_committers"] + dist_git_branches: From c68b187d3e7bb7abad42de4581975353ec042582 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 3 Mar 2025 10:08:19 +0800 Subject: [PATCH 48/56] Release 1.6.2-5 --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index f05d7ac..c3e8815 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Mon Mar 03 2025 Coiby Xu - 1.6.2-5 +- release 1.6.2-5 + * Fri Jan 17 2025 Fedora Release Engineering - 1.6.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From aed78ac85f6828d91491d656a97015c446797201 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:36:58 +0000 Subject: [PATCH 49/56] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index c3e8815..d8add48 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.6.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Mar 03 2025 Coiby Xu - 1.6.2-5 - release 1.6.2-5 From ac36e54bee77c82bd7f48a507d014a1ec0055645 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 10 Jul 2025 16:53:18 +0800 Subject: [PATCH 50/56] ima-setup: rebuild all initramfs images to include the integrity dracut module Resolves: https://issues.redhat.com/browse/RHEL-92638 Quoting Raju, ima-setup currently only rebuild the initramfs of running kernel, so the older kernel's(n-1 or n-2) initramfs does contain an outdated information or it does not contain ima module, as a result the system fails to boot with older kernel. It is always recommended to have at least 2 older kernel's kept installed on the system as a fallback option in case if the latest kernel fails to boot due to some unforeseen issue. So that we can boot the system with older kernel to troubleshoot the can't boot issue with older kernel. Suggested-by: Raju Cheerla --- ima-setup.sh | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/ima-setup.sh b/ima-setup.sh index ad2b595..1450c0a 100755 --- a/ima-setup.sh +++ b/ima-setup.sh @@ -120,15 +120,10 @@ load_ima_keys # automatically when there is a system reboot if ! lsinitrd --mod | grep -q integrity; then cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf - echo "Rebuilding the initramfs of kernel-$(uname -r) to include the dracut integrity module" - dracut -f - - if command -v grubby >/dev/null; then - _default_kernel=$(grubby --default-kernel | sed -En "s/.*vmlinuz-(.*)/\1/p") - if [[ $_default_kernel != $(uname -r) ]]; then - echo "Current kernel is no the default kernel ($_default_kernel), include dracut integrity for it as well" - dracut -f --kver "$_default_kernel" - fi + echo "Regenerating all initramfs images to include the dracut integrity module" + if ! dracut -f --regenerate-all; then + echo "Failed to Regenerate all initramfs images" + exit 1 fi [[ $(uname -m) == s390x ]] && zipl &> /dev/null fi From 48d137ffe5c95ed7dfc6d2960646432ce266d51f Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 10 Jul 2025 16:36:44 +0800 Subject: [PATCH 51/56] ima-add-sigs: Verify added IMA signature in case the file gets changed Resolves: https://issues.redhat.com/browse/RHEL-100320 Some IMA signatures from the RPM database may fail the verification because they can be changed. For examples, the following files on F41 can't pass IMA signature verification, /usr/lib64/gconv/gconv-modules.cache /boot/grub2/grubenv /var/lib/selinux/targeted/active/commit_num /var/lib/selinux/targeted/active/file_contexts /etc/ssh/sshd_config /etc/yum.repos.d/fedora-updates.repo /etc/yum.repos.d/fedora.repo /etc/group /etc/gshadow The kernel ima=fix mode won't generate IMA hash reference value for files with IMA signature. As a result, users can be denied the access to some files. So remove security.ima if a file fail the verification. --- ima-add-sigs.sh | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 6777d4b..890eacb 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -53,12 +53,35 @@ abort() { exit 1 } +get_system_ima_key() { + source /etc/os-release + local -A name_map=(['Fedora Linux']="fedora" ['Red Hat Enterprise Linux']="redhatimarelease" ['CentOS Stream']='centosimarelease') + local version_id + key_name=${name_map[$NAME]} + version_id=${VERSION_ID/.?/} + + [[ $key_name == fedora ]] && name_suffix=-ima + key_path=/etc/keys/ima/${key_name}-${version_id}${name_suffix}.der + if [[ ! -e $key_path ]]; then + echo "Failed to get system IMA code verification key" + exit 1 + fi + + echo -n "$key_path" +} + # Add IMA signatures from RPM database add_from_rpm_db() { if ! command -v setfattr &>/dev/null; then abort "Please install attr" fi + if [[ -e "$ima_cert" ]]; then + verify_ima_cert=$ima_cert + else + verify_ima_cert=$(get_system_ima_key) + fi + # use "|" as deliminator since it won't be used in a filename or signature while IFS="|" read -r path sig; do # [[ -z "$sig" ]] somehow doesn't work for some files that don't have IMA @@ -72,16 +95,22 @@ add_from_rpm_db() { continue fi + # Skip some files that are created on the fly + if [[ $path == "/usr/share/mime/"* || $path == "/etc/pki/ca-trust/extracted/"* ]]; then + continue + fi + if ! setfattr -n security.ima "$path" -v "0x$sig"; then echo "Failed to add IMA sig for $path" fi - [[ -e "$ima_cert" ]] || continue - # TODO - # don't verify the modified files like /etc? - if ! evmctl ima_verify -k "$ima_cert" "$path" &>/dev/null; then - echo "Failed to verify $path" + if ! evmctl ima_verify -k "$verify_ima_cert" "$path" &>/dev/null; then + setfattr -x security.ima "$path" + # When ima_cert is set, shows the verfication result for users + [[ -e "$ima_cert" ]] && "Failed to verify $path" + continue fi + done < <(rpm -q --queryformat "[%{FILENAMES}|%{FILESIGNATURES}\n]" "$package") } From 6f19220bcc3c5061ac44dd37f9e7abb1c8620a79 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Fri, 25 Jul 2025 09:11:06 +0800 Subject: [PATCH 52/56] Fix shellcheck warning and typos Fix the following shellcheck warning, In ima-add-sigs.sh line 135: unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep "^(none)$" | wc -l) ^-------------^ SC2126 (style): Consider using 'grep -c' instead of 'grep|wc -l'. Also fix two typos. Signed-off-by: Coiby Xu --- ima-add-sigs.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 890eacb..6be5c48 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -4,7 +4,7 @@ usage() { echo "Add IMA signatures to installed packages." cat <reinstall_threshold package missing IMA signatures. - --ima-cert + --ima_cert With the signing IMA cert path specified, it will also try to verify the added IMA signature. @@ -132,7 +132,7 @@ if [[ -z $reinstall_threshold ]]; then fi fi -unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep "^(none)$" | wc -l) +unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep -c "^(none)$") if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then add_by_reinstall From 47853f2cf6575812d28093b750be2f2e897c153d Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 16 Oct 2025 17:29:52 +0800 Subject: [PATCH 53/56] Use RSAHEADER to tell if a package has been signed Packages now use RPM v4 signature %{RSAHEADER}. %{SIGPGP} is the name of the RPM v3 header+payload signature and can't be used to tell if a package has been signed, # uname -r 6.16.10-200.fc42.x86_64 # rpm -q --queryformat "%{SIGPGP:pgpsig}\n" --all|grep -c "^(none)$" 586 # rpm -q --queryformat "%{RSAHEADER}\n" --all|grep -c "^(none)$" 5 Signed-off-by: Coiby Xu --- ima-add-sigs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 6be5c48..f0e9dd0 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -132,7 +132,7 @@ if [[ -z $reinstall_threshold ]]; then fi fi -unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep -c "^(none)$") +unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{RSAHEADER}\n" "$package" | grep -c "^(none)$") if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then add_by_reinstall From 7e1ffed77c9c75a3068cffd4ecd10cc2d7984cf3 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 27 Oct 2025 11:48:53 +0800 Subject: [PATCH 54/56] Allow packit to make and propose a build Currently, only users with commit access to the dist-git repo can make and propose a build. But packit doesn't have commit access to the repo. So explicitly allow packit to do make and propose a build. Fixes: e962d0c ("Use packit to automate ima-evm-utils releasing") Signed-off-by: Coiby Xu --- .packit.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.packit.yaml b/.packit.yaml index 3360032..a97cb7f 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -23,12 +23,12 @@ jobs: # PR in src.fedoraproject.org been merged. - job: koji_build trigger: commit - allowed_pr_authors: ["all_committers"] + allowed_pr_authors: ["all_committers", "packit"] dist_git_branches: - fedora-all # This is triggered at Fedora messaging bus about koji build finished. - job: bodhi_update trigger: commit - allowed_builders: ["all_committers"] + allowed_builders: ["all_committers", "packit"] dist_git_branches: From 3d7171c676d2290952cf481fae31ed0a347a3344 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 16 Oct 2025 17:36:34 +0800 Subject: [PATCH 55/56] Release 1.6.2-7 Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index d8add48..49588a3 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Oct 16 2025 Coiby Xu - 1.6.2-7 +- Use RSAHEADER to tell if a package has been signedn + * Thu Jul 24 2025 Fedora Release Engineering - 1.6.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 667e783b37838ccb6a2cb2198a22f280b2bb5548 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 27 Oct 2025 12:25:09 +0800 Subject: [PATCH 56/56] Fix a typo in changelog Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 49588a3..29915ec 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -146,7 +146,7 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %changelog * Thu Oct 16 2025 Coiby Xu - 1.6.2-7 -- Use RSAHEADER to tell if a package has been signedn +- ima-add-sigs: Use RSAHEADER to tell if a package has been signed * Thu Jul 24 2025 Fedora Release Engineering - 1.6.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild