【OLK 6.6】在6.6内核上适配IMA摘要列表特性补丁

IMA digest lists特性已在20.09版本落地到openEuler，由于内核需要进行大版本切换，适配补丁到6.6内核。

提交IMA补丁信息如下：

| 序号 | 对应commit id | commit描述 | 提交者 | 6.6是否需要适配 | 适配记录 |
|----|------------------------------------------|------------------------------------------------------------------------------|--------------------------------------------|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 | fbbb0268fec011e22e78aad77487255cffe6fd8e | initramfs: add file metadata | Mimi Zohar <zohar@linux.vnet.ibm.com> | 否 | |
| 2 | 4a8c66e1f02a44c9e8d1a483eceb9f1d51362a3c | initramfs: read metadata from special file METADATA!!! | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 3 | cba84c813aab94bbddef5c45a947dc90b234e405 | gen_init_cpio: add support for file metadata | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.usr/Makefile:64：上下文变更； 2.usr/gen_initramfs.sh：128：上下文变更； 3.usr/gen_initramfs.sh：244：上下文变更 |
| 4 | 10a5c18b87febc43b1b628d88354a393eea24742 | init: Add kernel option to force usage of tmpfs for rootfs | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1. init/do_mounts.c:31：上下文变更; 2.error: patch failed: init/do_mounts.c:333:代码位置变更 |
| 5 | dbe5fb8fdb336b5d944cf758a7e391e18e9488a3 | ima: Add enforce-evm and log-evm modes to strictly check EVM status | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 6 | f79392579af03b0d44815ca18fa9e669a6ff22f2 | ima: Allow choice of file hash algorithm for measurement and audit | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 7 | 4bdc37f9df2447e72604926c0eef78614d4875b1 | ima: Generalize ima_read_policy() | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 8 | 099adf45283830c50cb6056d32d1adc5dde0d26e | ima: Generalize ima_write_policy() and raise uploaded data size limit | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 9 | a57d01b572d93cba06a36d6357613d4deafa51f3 | ima: Generalize policy file operations | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 10 | d5c08c0eabe230f6f58a21f95d717de340113de6 | ima: Use ima_show_htable_value to show violations and hash table data | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 11 | 3da26851ea78a35501bb426092356a2b5fafd077 | ima: Add parser of compact digest list | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: security/integrity/ima/Kconfig:338：上下文变更 |
| 12 | e7648fc1000981bc185ebcd993f2fa43ca1cf38c | ima: Prevent usage of digest lists not measured or appraised | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 13 | 36cfb4dc88123811b4f8403e695044863905def2 | ima: Introduce new securityfs files | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 14 | 4ff8b9b1a7d83ac223e8143e9a46bdcb7d2d947b | ima: Introduce new hook DIGEST_LIST_CHECK | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 15 | 8521a235c315a52e8b2386dada8401d82c067c15 | ima: Load all digest lists from a directory at boot time | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: security/integrity/ima/Kconfig:348：上下文变更 |
| 16 | 34b2b1d6ad548f02b71677f483654d573d2fd0d8 | ima: Add support for measurement with digest lists | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: security/integrity/ima/ima_main.c:28：上下文变更 |
| 17 | d390bf832b4f322221f2f17560b2f767d3c79692 | ima: Add support for appraisal with digest lists | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 18 | 1da9622241008a6c6efe44c1dc2fd284ec20ed06 | evm: Add support for digest lists of metadata | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 19 | 293f51e38b1d17f07c428bcb76524a9b29a7cf4c | ima: Add meta_immutable appraisal type | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.security/integrity/ima/ima_policy.c:1293: 上下文变更； 2.security/integrity/ima/ima_policy.c:1834： 上下文变更; 3.security/integrity/ima/ima_policy.c:2295:上下文变更； |
| 20 | 44f55215f4f3bc12d662efc7b69fbdaf0168bdde | ima: Introduce exec_tcb policy | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 21 | 799722e1756da7565b785a9f8b879f2b3084d261 | ima: Introduce appraise_exec_tcb policy | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 22 | 4b14a2fd9172b128f5efeef0594ab9e932e51200 | ima: Introduce appraise_exec_immutable policy | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 23 | e41e53f1acc33c5afebb53c2c1df3ab4ce64fb3b | ima: Add Documentation/security/IMA-digest-lists.txt | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 24 | 44209fafd635ed7a1234280e0c0a0d8e1e2f08aa | mpi: introduce mpi_key_length() | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: lib/mpi/mpicoder.c: No such file or directory：文件路径变更为"lib/crypto/mpi/mpicoder.c" |
| 25 | e9c4215cdb2f932dc347d9025bd7619bdfacbfa6 | rsa: add parser of raw format | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 26 | 63f626a42bb8adfd8c15a211bc5af8df3e333c12 | PGPLIB: PGP definitions (RFC 4880) | David Howells <dhowells@redhat.com> | 否 | |
| 27 | 26ac06df83481a897881499161e8b88c7f44a5b2 | PGPLIB: Basic packet parser | David Howells <dhowells@redhat.com> | 是 | 1.error: patch failed: crypto/asymmetric_keys/Kconfig:85：上下文变更 |
| 28 | d0527df889a92fc15a27457794d952665f1aedff | KEYS: PGP data parser | David Howells <dhowells@redhat.com> | 否 | |
| 29 | 3b49713f9cd4d912c54eda889f9ac02d5b5db4bd | KEYS: Provide PGP key description autogeneration | David Howells <dhowells@redhat.com> | 否 | |
| 30 | 6fb80957101cc5fd713e379af71e80f2f2cfecb5 | KEYS: Introduce load_pgp_public_keyring() | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 31 | 77ced5b8e42fd8f6f5006059eb85b98161f3b21c | KEYS: Provide a function to load keys from a PGP keyring blob | David Howells <dhowells@redhat.com> | 否 | |
| 32 | cccf731150ea7970c46bfe8fbad0adf6d48c1f4b | certs: Introduce search_trusted_key() | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: include/linux/verification.h:9：上下文变更 |
| 33 | ea556bb687360cc90d752b23c613da4677c9197e | ima: Search key in the built-in keyrings | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 34 | dc9fbe603c1ec686216de9ceda1b3392735d58b6 | ima: Allow direct upload of digest lists to securityfs | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 35 | 43b164b219b4907e98ba4af77e2a1188770b93a3 | ima: Add parser keyword to the policy | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 36 | bf52a8259a21e2d6189909b6e30f634fb1989b56 | evm: Extend evm= with x509. allow_metadata_writes and complete values | Roberto Sassu <roberto.sassu@huawei.com> | 否 | |
| 37 | 3f9ed3300f593aa87ae8363bef84c1ba5e404775 | ima: Execute parser to upload digest lists not recognizable by the kernel | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: security/integrity/ima/Kconfig:356：上下文变更 |
| 38 | aa97d9bb07ebd3f1685268f1f80bb6eee94d3954 | evm: Propagate choice of HMAC algorithm in evm_crypto.c | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: security/integrity/evm/evm_crypto.c:405：上下文变更 |
| 39 | 5d7049150431029bdbefe4160ec5e859901053e0 | config: add digest list options for arm64 and x86 | Roberto Sassu <roberto.sassu@huawei.com> | 是 | 1.error: patch failed: arch/x86/configs/openeuler_defconfig:4368：上下文变更 |
| 40 | 773af1d8c2259eb8a915b1283c98d8ee65f4e0b7 | ima: Add max size for IMA digest database | Zhang Tianxing <zhangtianxing3@huawei.com> | 是 | 1.error: patch failed: security/integrity/ima/Kconfig:405：上下文变更 |
| 41 | a4a645ec3deeb13102aec84b1750f2c0c94a863e | ima: don't allow control characters in policy path | Zhang Tianxing <zhangtianxing3@huawei.com> | 否 | |

本次新增补丁如下：
主要是解决openEuler defaulf config问题

| 序号 | 对应commit id | commit描述 | 提交者 | 6.6是否需要适配 | 适配记录 |
|----|------------------------------------------|----------------------------------------------------------|-------------------------------------------|-----------|------|
| 1 | fe80de8a978f3f4d683fe7913a3e574497bb89ef | ima: add default INITRAMFS_FILE_METADATA and EVM_DEFAULT_HASH CONFIG | zhangguangzhi <zhangguangzhi3@huawei.com> | 否 |

GVP openEuler/kernel
关闭

内容风险标识

评论 (6)

GVPopenEuler/kernel关闭

内容风险标识