57 lines
1.6 KiB
Diff
57 lines
1.6 KiB
Diff
From 15d8e3a327bc4ee96845163f962837cfcb4699bb Mon Sep 17 00:00:00 2001
|
|
From: Kam Nasim <kam.nasim@windriver.com>
|
|
Date: Tue, 6 Feb 2018 15:25:00 -0500
|
|
Subject: [PATCH] CGTS-8849: Security: Set immutable attribute and permissions
|
|
|
|
---
|
|
SPECS/tboot.spec | 18 +++++++++++++++---
|
|
1 file changed, 15 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/SPECS/tboot.spec b/SPECS/tboot.spec
|
|
index 4c479ad..d0039d4 100644
|
|
--- a/SPECS/tboot.spec
|
|
+++ b/SPECS/tboot.spec
|
|
@@ -43,8 +43,14 @@ if [ -e "/sys/firmware/efi" ]; then
|
|
putk "WARNING: tboot is not supported on UEFI-based systems."
|
|
putk " Please see https://access.redhat.com/articles/2217041."
|
|
putk " and https://access.redhat.com/articles/2464721"
|
|
- exit 0;
|
|
fi
|
|
+# On updating this package, we want to clear the immutable
|
|
+# attribute so that the module files can get overwritten
|
|
+if [ $1 -gt 1 ]; then
|
|
+ chattr -i /boot/tboot.gz /boot/tboot-syms
|
|
+fi
|
|
+exit 0
|
|
+
|
|
|
|
%install
|
|
rm -rf $RPM_BUILD_ROOT
|
|
@@ -53,6 +59,12 @@ make debug=y DISTDIR=$RPM_BUILD_ROOT install
|
|
%clean
|
|
rm -rf $RPM_BUILD_ROOT
|
|
|
|
+%post
|
|
+# Set immutable attribute on tboot modules
|
|
+chattr +i /boot/tboot.gz /boot/tboot-syms
|
|
+exit 0
|
|
+
|
|
+
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
%doc README COPYING docs/* lcptools/lcptools2.txt lcptools/Linux_LCP_Tools_User_Manual.pdf
|
|
@@ -89,8 +101,8 @@ rm -rf $RPM_BUILD_ROOT
|
|
%{_mandir}/man8/lcp_writepol.8.gz
|
|
%{_mandir}/man8/tb_polgen.8.gz
|
|
%{_mandir}/man8/txt-stat.8.gz
|
|
-/boot/tboot.gz
|
|
-/boot/tboot-syms
|
|
+%attr(0400,root,root) /boot/tboot.gz
|
|
+%attr(0400,root,root) /boot/tboot-syms
|
|
|
|
%changelog
|
|
* Fri Jan 27 2017 Tony Camuso <tcamuso@redhat.com> - 1:1.9.5-1
|
|
--
|
|
1.8.3.1
|
|
|