MSVSphere Packaging Team
1 year ago
parent
8b3980342b
commit
97ff2a2e64
@ -0,0 +1,59 @@
|
||||
--- a/scripts/create_runtime_policy.sh 2023-10-09 17:04:26.121194607 +0200
|
||||
+++ b/scripts/create_runtime_policy.sh 2023-10-09 17:06:02.089855614 +0200
|
||||
@@ -42,7 +42,7 @@
|
||||
exit $NOARGS;
|
||||
fi
|
||||
|
||||
-ALGO=sha1sum
|
||||
+ALGO=sha256sum
|
||||
|
||||
ALGO_LIST=("sha1sum" "sha256sum" "sha512sum")
|
||||
|
||||
@@ -78,7 +78,7 @@
|
||||
|
||||
|
||||
# Where to look for initramfs image
|
||||
-INITRAMFS_LOC="/boot/"
|
||||
+INITRAMFS_LOC="/boot"
|
||||
if [ -d "/ostree" ]; then
|
||||
# If we are on an ostree system change where we look for initramfs image
|
||||
loc=$(grep -E "/ostree/[^/]([^/]*)" -o /proc/cmdline | head -n 1 | cut -d / -f 3)
|
||||
@@ -121,7 +121,7 @@
|
||||
cp -r /tmp/ima/$i-extracted-unmk/. /tmp/ima/$i-extracted
|
||||
fi
|
||||
elif [[ -x "/usr/lib/dracut/skipcpio" ]] ; then
|
||||
- /usr/lib/dracut/skipcpio $i | gunzip -c | cpio -i -d 2> /dev/null
|
||||
+ /usr/lib/dracut/skipcpio $i | gunzip -c 2> /dev/null | cpio -i -d 2> /dev/null
|
||||
else
|
||||
echo "ERROR: No tools for initramfs image processing found!"
|
||||
break
|
||||
@@ -130,9 +130,26 @@
|
||||
find -type f -exec $ALGO "./{}" \; | sed "s| \./\./| /|" >> $OUTPUT
|
||||
done
|
||||
|
||||
-# Convert to runtime policy
|
||||
-echo "Converting created allowlist to Keylime runtime policy"
|
||||
-python3 $WORKING_DIR/../keylime/cmd/convert_runtime_policy.py -a $OUTPUT -o $OUTPUT
|
||||
+# when ROOTFS_LOC = '/', the path starts on allowlist ends up with double '//'
|
||||
+#
|
||||
+# Example:
|
||||
+#
|
||||
+# b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c //bar
|
||||
+#
|
||||
+# Replace the unwanted '//' with a single '/'
|
||||
+sed -i 's| /\+| /|g' $ALLOWLIST_DIR/${OUTPUT}
|
||||
+
|
||||
+# When the file name contains newlines or backslashes, the output of sha256sum
|
||||
+# adds a backslash at the beginning of the line.
|
||||
+#
|
||||
+# Example:
|
||||
+#
|
||||
+# $ echo foo > ba\\r
|
||||
+# $ sha256sum ba\\r
|
||||
+# \b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c ba\\r
|
||||
+#
|
||||
+# Remove the unwanted backslash prefix
|
||||
+sed -i 's/^\\//g' $ALLOWLIST_DIR/${OUTPUT}
|
||||
|
||||
# Clean up
|
||||
rm -rf /tmp/ima
|
||||
@ -0,0 +1,44 @@
|
||||
diff --git a/keylime/cloud_verifier_common.py b/keylime/cloud_verifier_common.py
|
||||
index a7399d2..c0f416d 100644
|
||||
--- a/keylime/cloud_verifier_common.py
|
||||
+++ b/keylime/cloud_verifier_common.py
|
||||
@@ -8,7 +8,7 @@ from keylime.agentstates import AgentAttestState, AgentAttestStates, TPMClockInf
|
||||
from keylime.common import algorithms
|
||||
from keylime.db.verifier_db import VerfierMain
|
||||
from keylime.failure import Component, Event, Failure
|
||||
-from keylime.ima import file_signatures
|
||||
+from keylime.ima import file_signatures, ima
|
||||
from keylime.ima.types import RuntimePolicyType
|
||||
from keylime.tpm import tpm_util
|
||||
from keylime.tpm.tpm_main import Tpm
|
||||
@@ -271,7 +271,7 @@ def process_get_status(agent: VerfierMain) -> Dict[str, Any]:
|
||||
logger.debug('The contents of the agent %s attribute "mb_refstate" are %s', agent.agent_id, agent.mb_refstate)
|
||||
|
||||
has_runtime_policy = 0
|
||||
- if agent.ima_policy.generator and agent.ima_policy.generator > 1:
|
||||
+ if agent.ima_policy.generator and agent.ima_policy.generator > ima.RUNTIME_POLICY_GENERATOR.EmptyAllowList:
|
||||
has_runtime_policy = 1
|
||||
|
||||
response = {
|
||||
diff --git a/keylime/cmd/create_policy.py b/keylime/cmd/create_policy.py
|
||||
index 0841d64..086b92a 100755
|
||||
--- a/keylime/cmd/create_policy.py
|
||||
+++ b/keylime/cmd/create_policy.py
|
||||
@@ -6,6 +6,7 @@ import argparse
|
||||
import binascii
|
||||
import collections
|
||||
import copy
|
||||
+import datetime
|
||||
import gzip
|
||||
import json
|
||||
import multiprocessing
|
||||
@@ -580,6 +581,9 @@ def main() -> None:
|
||||
policy["excludes"] = sorted(list(set(policy["excludes"])))
|
||||
policy["ima"]["ignored_keyrings"] = sorted(list(set(policy["ima"]["ignored_keyrings"])))
|
||||
|
||||
+ policy["meta"]["generator"] = ima.RUNTIME_POLICY_GENERATOR.LegacyAllowList
|
||||
+ policy["meta"]["timestamp"] = str(datetime.datetime.now())
|
||||
+
|
||||
try:
|
||||
ima.validate_runtime_policy(policy)
|
||||
except ima.ImaValidationError as ex:
|
||||
Loading…
Reference in new issue