This is an RFC patch series to get early feedback on stuff I am working
This series does few things.
- Adds an extra structure to ima signature (security.ima) which will signal
the elf loader that this executable needs to be locked. This will be
useful for secureboot where signed /sbin/kexec needs to run memory
I have posted RFC kernel patches on Fedora kernel mailing list.
kexec-tools patches are posted here.
- Add a functionality to import signatures signed externally. (Patch 2)
- Add functionality to allow signing using external crypto card. (Patch 3)
- Add a functionality to create a daemon which cilents can connect to
and request file signing (Patch 4 and Patch 5).
All the signing enhancements I need so that various build servers can
make use of it to sign /sbin/kexec and bzImage using appropriate keys.
This is still a work in progress and code is very raw. I wanted to get
the code out to get early feedback.
Vivek Goyal (5):
evmctl: Allow adding a memlock information in security.ima
evmctl: Allow importing external signature
evmctl: Allow signing using external crypto engine
evmctl-client: A simple client to request signing from evmctl daemon
configure.ac | 1 +
src/Makefile.am | 9 +-
src/client.c | 697 +++++++++++++++++++++++++++++++++
src/daemon.h | 83 ++++
src/evmctl.c | 1166 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
5 files changed, 1934 insertions(+), 22 deletions(-)
create mode 100644 src/client.c
create mode 100644 src/daemon.h