diff --git a/digest-list-tools.spec b/digest-list-tools.spec index 68190d3..cef03ac 100644 --- a/digest-list-tools.spec +++ b/digest-list-tools.spec @@ -1,6 +1,6 @@ name: digest-list-tools Version: 0.3.95 -Release: 14 +Release: 15 Summary: Utilities for IMA Digest Lists extension Source0: https://gitee.com/openeuler/%{name}/repository/archive/v%{version}.tar.gz @@ -19,6 +19,7 @@ Patch7: fix-error-exit-in-dracut-program.patch Patch8: fix-cap_struct-to-adapter-libcap-2.61.patch Patch9: fix-the-compilation-error.patch Patch10: allow-a-specified-algo-different-from-the-list-file.patch +Patch11: dracut-script-support-loading-digest-list-with-modsi.patch Requires: libcap >= 2.61 BuildRequires: autoconf automake libcurl-devel libtool rpm-devel dracut gzip @@ -131,6 +132,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man1/%{name}.1.gz %changelog +* Fri Aug 16 2024 luhuaxin - 0.3.95-15 +- dracut script support loading digest list with modsig + * Tue Aug 22 2023 zhoushuiqing - 0.3.95-14 - Allowing a specified algorithm different from the list file. diff --git a/dracut-script-support-loading-digest-list-with-modsi.patch b/dracut-script-support-loading-digest-list-with-modsi.patch new file mode 100644 index 0000000..deda485 --- /dev/null +++ b/dracut-script-support-loading-digest-list-with-modsi.patch @@ -0,0 +1,29 @@ +From 1e46b6c1440b0aece5bb45ef8bc432a16d64248d Mon Sep 17 00:00:00 2001 +From: Huaxin Lu +Date: Fri, 16 Aug 2024 10:57:33 +0800 +Subject: [PATCH] dracut script support loading digest list with modsig + +Signed-off-by: Huaxin Lu +--- + initrd/dracut/load_digest_lists.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/initrd/dracut/load_digest_lists.sh b/initrd/dracut/load_digest_lists.sh +index 8cb3e84..fad24ed 100644 +--- a/initrd/dracut/load_digest_lists.sh ++++ b/initrd/dracut/load_digest_lists.sh +@@ -10,7 +10,10 @@ if [ -f /sys/kernel/security/ima/digest_list_data ]; then + if ($1 ~ /security.ima=0x03/) ima=1; } + END{ if (evm || ima) print "1" }') + if [ -z "$process_digest_list" ]; then +- continue ++ tail -c 32 $f | grep -a "~Module signature appended~" &> /dev/null ++ if [ $? -ne 0 ]; then ++ continue ++ fi + fi + + format=$(echo $f | cut -d - -f 3) +-- +2.33.0 +