hackers-terabit/imahelper.sh

## imahelper.sh
#!/bin/bash
whitelist="./whitelist"
verbose=1
#generate unencrypted openssl pub/private rsa keypair
echo "generating signing key"
openssl genrsa -out /etc/rsa_private.pem 4096
openssl rsa -pubout -in /etc/rsa_private.pem -out /etc/rsa_public.pem

#import public signing key
ima_id=`keyctl newring _ima @u`
evmctl import --rsa /etc/rsa_public.pem $ima_id
echo "Imported signing key"

echo "Measuring and signing files not found in whitelist"
echo "This will take a very long time, go watch a movie or something..."
find / \( -fstype rootfs -o -fstype ext4 \) -type f | grep -vf $whitelist |
	while read filepath
		do
			#measure
			evmctl ima_hash "$filepath"
			#sign for appraisal excluding whitelist paths
			evmctl  sign  --rsa  -k /etc/rsa_private.pem  --uuid --imasig "$filepath"
			if [ $verbose -ge 1 ]
			then
				echo "Measured/Appraised:$filepath"
			fi
		done

echo "Done."
	#!/bin/bash
	whitelist="./whitelist"
	verbose=1
	#generate unencrypted openssl pub/private rsa keypair
	echo "generating signing key"
	openssl genrsa -out /etc/rsa_private.pem 4096
	openssl rsa -pubout -in /etc/rsa_private.pem -out /etc/rsa_public.pem

	#import public signing key
	ima_id=`keyctl newring _ima @u`
	evmctl import --rsa /etc/rsa_public.pem $ima_id
	echo "Imported signing key"

	echo "Measuring and signing files not found in whitelist"
	echo "This will take a very long time, go watch a movie or something..."
	find / \( -fstype rootfs -o -fstype ext4 \) -type f \| grep -vf $whitelist \|
	while read filepath
	do
	#measure
	evmctl ima_hash "$filepath"
	#sign for appraisal excluding whitelist paths
	evmctl sign --rsa -k /etc/rsa_private.pem --uuid --imasig "$filepath"
	if [ $verbose -ge 1 ]
	then
	echo "Measured/Appraised:$filepath"
	fi
	done

	echo "Done."