.\" Text automatically generated by txt2man
.TH gen_digest_lists  "03 June 2020" "" ""
.SH NAME
\fBgen_digest_lists \fP- generate a digest list
\fB
.RE
\fB
.SH SYNOPSIS
.nf
.fam C
\fBgen_digest_lists\fP [\fIoptions\fP]


.fam T
.fi
.fam T
.fi
.SH DESCRIPTION
\fBgen_digest_lists\fP can be used to generate digest lists with one of the
available generators (e.g. rpm, ima).
.RE
.PP

.SH OPTIONS
\fB-d\fP <directory>: directory containing digest lists
.PP
\fB-f\fP <format>: format of the input file, syntax: <generator ID>+<generator func>
.PP
\fB-i\fP <path>: path of the input file
.PP
\fB-o\fP <operation>: operation to do:
.RS
.IP \(bu 3
add: insert a new digest list at the position specified
.IP \(bu 3
append: add a new digest list after the existing ones
.IP \(bu 3
remove: remove a digest list at the position specified
.IP \(bu 3
sign: sign a digest list
.RE
.PP
\fB-p\fP <position>: position of the file in the directory to add/remove
.PP
\fB-t\fP <compact id>: type of compact list to generate
.PP
\fB-T\fP: generate a TLV compact list
.PP
\fB-m\fP <modifiers>: compact list modifiers separated by comma
.PP
\fB-a\fP <algorithm>: digest list hash algorithm
.PP
\fB-I\fP <algo>: IMA hash algorithm
.PP
\fB-s\fP: sign generated digest lists
.PP
\fB-k\fP <key>: key to sign
.PP
\fB-w\fP [<key password>]: key password or prompt
.PP
\fB-A\fP <alt root>: alternative root for SELinux labeling
.PP
\fB-h\fP: display help
.RE
.PP

.RS
Generator specific \fIoptions\fP can be specified in the command line with the format
\fB-i\fP <option arg>:<option value>
.PP
compact/unknown:
i: : include file digest in the digest list if digest list type is metadata
I: : file or directory to include in the digest list
L:<path> : take the list of files to include in the digest list from a file
G:<path> : generate a list of file to include in the digest list instead of the
digest list itself
l:<|policy> : include SELinux label in the calculation of the EVM digest;
specify policy to force retrieving the label from the policy
instead of security.selinux
e: : select only files with execute bit set
u: : take the file name of the new digest list from the L: option
r: : use zero as UID/GID values
F: : force inclusion of files without execute bit set even if e: option is
specified
x: : set security.ima
.PP
rpm:
i: : include file digest in the digest list if digest list type is metadata
.PP
F: : force inclusion of files without execute bit set even if e: option is
specified
l:<|policy> : include SELinux label in the calculation of the EVM digest;
specify policy to force retrieving the label from the policy
instead of security.selinux
e: : select only files with execute bit set
x: : set security.ima
f:<compact|compact_tlv> : convert to compact format (non-TLV or TLV) instead
of writing the RPM header to the new file
p:<package> : create a digest list from RPM database, only from packages
whose name starts with 'package'
.PP
unknown:
D:<path> : preload existing digest lists in memory so that only unknown files
(content or metadata, depending on the digest list type) are included
in the digest list
.RE
.PP

.SH EXAMPLES
Generate a compact digest list for each installed RPM package and copy it to
/etc/ima/digest_lists.
.PP
# \fBgen_digest_lists\fP \fB-f\fP rpm+db \fB-t\fP file \fB-o\fP append
.PP
Generate an RPM digest list from an RPM package and copy it to
/etc/ima/digest_lists.
.PP
# \fBgen_digest_lists\fP \fB-f\fP rpm+pkg \fB-i\fP <RPM path> \fB-t\fP file \fB-o\fP append
.PP
Generate a compact digest list of immutable files from the IMA measurement
list.
.PP
# \fBgen_digest_lists\fP \fB-f\fP ima+ima_ng \fB-t\fP file_immutable \fB-o\fP append
.RE
.PP

.SH AUTHOR
Written by Roberto Sassu, <roberto.sassu at huawei.com>.
.RE
.PP

.SH COPYING
Copyright (C) 2017-2020 Huawei Technologies Duesseldorf GmbH. Free use of
this software is granted under the terms of the GNU Public License 2.0
(GPLv2).