From: Matthias Gerstner <matthias.gerstner@suse.de>
Date: Wed, 24 Jan 2018 16:19:03 +0000 (+0100)
Subject: 98integrity: support X.509-only EVM configuration
X-Git-Tag: 047~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f48fb6f4ce277a7ca1a89b6c6423326c42da601e;p=thirdparty%2Fdracut.git

98integrity: support X.509-only EVM configuration

Previously if no symmetric key was configured for EVM, then the
initialization process was aborted. It can be a valid use case, however,
to only use EVM digital signatures. In this case only X.509 certificates
need to be loaded.

With this change EVM initialization will continue if any of the
symmetric or X.509 keys could be loaded.
---

diff --git a/modules.d/98integrity/evm-enable.sh b/modules.d/98integrity/evm-enable.sh
index 0be16a41b..4f73b8855 100755
--- a/modules.d/98integrity/evm-enable.sh
+++ b/modules.d/98integrity/evm-enable.sh
@@ -125,11 +125,18 @@ enable_evm()
         return 0
     fi
 
-    # load the EVM encrypted key
-    load_evm_key || return 1
+    local evm_configured
+
+    # try to load the EVM encrypted key
+    load_evm_key && evm_configured=1
+
+    # try to load the EVM public key
+    load_evm_x509 && evm_configured=1
 
-    # load the EVM public key, if it exists
-    load_evm_x509
+    # only enable EVM if a key or x509 certificate could be loaded
+    if [ -z "$evm_configured" ]; then
+        return 1
+    fi
 
     # initialize EVM
     info "Enabling EVM"