54 lines
1.4 KiB
Diff
54 lines
1.4 KiB
Diff
From 15d8e3a327bc4ee96845163f962837cfcb4699bb Mon Sep 17 00:00:00 2001
|
|
From: Kam Nasim <kam.nasim@windriver.com>
|
|
Date: Tue, 6 Feb 2018 15:25:00 -0500
|
|
Subject: [PATCH] CGTS-8849: Security: Set immutable attribute and permissions
|
|
|
|
---
|
|
SPECS/tboot.spec | 16 ++++++++++++++--
|
|
1 file changed, 14 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/SPECS/tboot.spec b/SPECS/tboot.spec
|
|
index f04dd17..1673095 100644
|
|
--- a/SPECS/tboot.spec
|
|
+++ b/SPECS/tboot.spec
|
|
@@ -75,6 +75,13 @@ if [ -e "/sys/firmware/efi" ]; then
|
|
exit 0;
|
|
fi
|
|
|
|
+# On updating this package, we want to clear the immutable
|
|
+# attribute so that the module files can get overwritten
|
|
+if [ $1 -gt 1 ]; then
|
|
+ chattr -i /boot/tboot.gz /boot/tboot-syms
|
|
+fi
|
|
+exit 0
|
|
+
|
|
%install
|
|
rm -rf $RPM_BUILD_ROOT
|
|
make debug=y DISTDIR=$RPM_BUILD_ROOT install
|
|
@@ -82,6 +89,11 @@ make debug=y DISTDIR=$RPM_BUILD_ROOT install
|
|
%clean
|
|
rm -rf $RPM_BUILD_ROOT
|
|
|
|
+%post
|
|
+# Set immutable attribute on tboot modules
|
|
+chattr +i /boot/tboot.gz /boot/tboot-syms
|
|
+exit 0
|
|
+
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
%doc README COPYING docs/* lcptools/lcptools2.txt lcptools/Linux_LCP_Tools_User_Manual.pdf
|
|
@@ -118,8 +130,8 @@ rm -rf $RPM_BUILD_ROOT
|
|
%{_mandir}/man8/lcp_writepol.8.gz
|
|
%{_mandir}/man8/tb_polgen.8.gz
|
|
%{_mandir}/man8/txt-stat.8.gz
|
|
-/boot/tboot.gz
|
|
-/boot/tboot-syms
|
|
+%attr(0400,root,root) /boot/tboot.gz
|
|
+%attr(0400,root,root) /boot/tboot-syms
|
|
|
|
%changelog
|
|
* Mon Jul 16 2018 Tony Camuso <tcamuso@redhat.com> - 1:1.9.6-3
|
|
--
|
|
2.7.4
|
|
|