An apparmor profile was added for Debian-based distributions in order to
increase security. This blocks swtpm from accessing restricted and unnecessary
files, folders, and network interfaces. swtpm works as normal alongside libvirt
and its configurations, however users may run into issues when using swtpm on
its own when providing it with a restricted directory. The apparmor profile can
be modified to include additional permissions by creating and adding to the
file /etc/apparmor.d/local/usr.bin.swtpm.
Signed-off-by: Lena Voytek <lena.voytek@canonical.com>
- Move content of swtpm-localca(8) manual page to swtpm_localca(8)
and make swtpm-localca(8) an alias for swtpm_localca(8), mirroring
the fact that /usr/bin/swtpm_localca is the actual program and
/usr/share/swtpm/swtpm-localca a wrapper for it.
- Change references to `swtpm-localca` in manual pages' content to
`swtpm_localca`, reflecting the actual name of the program they are
meant to document.
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
- debian/clean: Add files that were not being automatically cleaned
up by dh(1)'s `clean` target.
- debian/control:
- Add new recommended/required fields and bump Standards-Version.
- Remove redundant build dependencies that are implied transitively.
- Bump debhelper dependency version to match debian/compat.
- Move swtpm-libs's ${misc:Pre-Depends} dependency to `Pre-Depends`.
Resolves `depends-on-misc-pre-depends` Lintian warning.
- Sort packages and dependency lists alphabetically as per
wrap-and-sort(1).
- debian/not-installed: List deliberately non-installed files to
avoid dh_missing(1) warnings.
- debian/rules:
- Pass --no-scripts to dh_makeshlibs(1) in order to keep a
ldconfig(8) trigger from being implicitly added, which for
this package was redundant and triggered Lintian warning
`package-has-unnecessary-activation-of-ldconfig-trigger`.
- Remove redundant --parallel dh flag.
- Remove redundant dh_usrlocal override.
- debian/*.install:
- Add swtpm-create-tpmca(8) and its manpage, which were missing.
- Remove redundant `#! /usr/bin/dh-exec` lines.
- Sort entries alphabetically as per wrap-and-sort(1).
- debian/swtpm-tools.postinst.in: Add `set -e` to fail in case of
error. Fixes `maintainer-script-ignores-errors` Lintian warning.
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
Remove the CUSE TPM from the build and adjust the rules file
so that the build works on Ubuntu servers for example.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Libtpms is now libtpms0 as a dependency.
Gnutls is neede for swtpm_cert to create the certs. Force it to
be available.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix the Debian packaging if swtpm_cert is missing. We convert
swtpm-tools.install into an executable shell script that displays
all files to package.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Exclude the swtpm_cert tool and its man page if it is not found
due to it not being compiled due to backlevel gnutls library.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add debian build files to enable building of Debian package using for exampl
debuild -b or dpkg-buildpackage -us -uc
Extend the .gitignore.
The debhelper checks show warnings and errors that will need to be addressed
some other time. For some I don't know how to solve them at the moment.
Signed-off-by: Stefan Berger <stefanb@linux.watson.ibm.com>
