integrity-sign(8)

INTEGRITY-SIGN(8)

IMA and EVM

INTEGRITY-SIGN(8)

NAME

integrity-sign - IMA and EVM signing tool

SYNOPSIS

integrity-sign [ --stdin ] --sign [ -a HASH | --hash=HASH ] [ -E | --with-evm ] [ --without-evm ] [ --log FILE ] [ --cert=CERT.pem ] [ --key=KEY.pem ] [ -B BASENAME | --basename=BASENAME ] [ -U | --update ] [ -v | --verbose ]
integrity-sign -l | --list
integrity-sign [ --stdin ] --verify [ -E | --with-evm ] [ --without-evm ] [ -v | --verbose ]
integrity-sign -h | --help
integrity-sign -V | --version

DESCRIPTION

integrity-sign is an IMA and EVM signing tool. Normally, it is invoked by the higher-level integrity-applier tool. After a successful enforcement of IMA/EVM the filesystem can be checked with integrity-sign --verify command.

For operations on individual files there is --stdin option. For instance, to sign the /bin/bash file with an existing private key, use the following command:

echo /bin/bash | integrity-sign --stdin --sign --key=mykey.pem

(that is analoguos to `evmctl ima_sign --key=mykey.pem /bin/bash`). And to verify an individual file signature, use:

echo /bin/bash | integrity-sign --stdin --verify -v

Note, that the log file is not (over)written by default in --stdin mode.

The public certificates used for verification are those installed into /etc/keys/ directory. Moreover, when the kernel is loaded in IMA enforcement mode, only those certificates that are loaded into the system IMA keyring are used for verification. However, there is currently no way to directly use the kernel certificates and an attempt is made to find the corresponding ones among /etc/keys/*_ima.der files.

WARNING! The use of -U | --update option is rather dangerous, as it is here to update the contents of /etc/keys/ directory. Use it with caution and only when you know what you are doing. Note, that for most simple scenarios integrity-applier should be enough.

The -B BASENAME | --basename=BASENAME option can be used to specify the base name of the certificate file that is installed in /etc/keys/ when the -U | --update option is passed.

The special -R | --resign option is here to control the overwriting of existing IMA signatures. However, the integrity-applier utility automatically pass it to integrity-sign when the signing is done with an on-the-fly generated one-time key (the default mode!).

For more information see integrity(7) manual page.

BUGS

Report bugs to https://bugzilla.altlinux.org/.

COPYRIGHT

Copyright © BaseALT, Ltd. License GPLv2+: GNU GPL version 2 or later See <http://gnu.org/licenses/gpl.html> for more information.
This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.