summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* audit: drop version 2.8.5Yi Zhao2023-03-055-405/+0
| | | | | | | | Removed version 2.8.5, as the 2.8 series is no longer maintained since 2020. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.9 -> 3.1Yi Zhao2023-03-051-4/+4
| | | | | | | | | | | | | | | | ChangeLog: https://github.com/linux-audit/audit-userspace/releases/tag/v3.1 Major features: Add new record types Add io_uring support Add support for new FANOTIFY record fields * Remove redundant python3native as it is already inherited by python3targetconfig * Fix indentation Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* bubblewrap: upgrade 0.7.0 -> 0.8.0Wang Mingyu2023-03-041-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: enable objectstore backendJan Luebbe2023-02-011-0/+1
| | | | | | | | | | | We already depend on sqlite, but the objectstore backend using it is not enabled by default. Add the necessary configure option. The db backend is more robust when accessing the objectstore from many parallel processes (such as during kernel module signing). Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: avoid unnecessary check for native sqlite binaryJan Luebbe2023-02-012-1/+43
| | | | | | | | | SoftHSMv2 actually only uses the sqlite library. With the check for the sqlite3 binary, building with the DB backend would mean depending on sqlite-native. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: fix Upstream-Status formattingMartin Jansa2023-01-271-1/+1
| | | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Fix build with gcc13Khem Raj2023-01-272-0/+46
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: Upgrade 1.6.1 -> 1.6.3Alex Kiernan2023-01-265-13/+139
| | | | | | | | | | | Move SRC_URI to git as there's no tarball for 1.6.3. Fix failing tests when busybox is providing `head`. Pull in reproducibility fix from Arch Linux. Remove autoconf inherit as this is a simple Makefile package. Add manpages support via inherit so man-db is updated. Add missing ptest dependencies. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Upgrade 1.1.1 -> 1.1.2Alex Kiernan2023-01-061-1/+1
| | | | | Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Remove pegtl from DEPENDSAlex Kiernan2023-01-061-3/+3
| | | | | | | | | | | | Using `DEPENDS = "pegtl"` with `--with-bundled-pegtl` doesn't make sense, so drop the DEPENDS. Also add github-releases checking for newer versions. Drop redundant setting of `S` to the default. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* bubblewrap: import recipe from meta-securityMarkus Volk2022-12-231-0/+24
| | | | | Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: fix ptest failed since "+++ Can't Determine Endianness"Changqing Li2022-12-052-0/+36
| | | | | | | | All the ptest cases are failed since error "+++ Can't Determine Endianness", update the regex for matching the endianness to fix this issue. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Inherit python3targetconfigKhem Raj2022-11-301-1/+1
| | | | | | | | | | | It uses python3-config during build to grok the python specific includedirs, therefore its important to ensure that target specific python3-config is used, otherwise currently it defaults to native python3-config which ends up adding native python3 include paths which might work out ok but is exposed when target is 32bit + lfs enabled, the headers don't match between native and target python Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.8 -> 3.0.9Wang Mingyu2022-11-281-1/+1
| | | | | | | | | | | | | | | Changelog: =========== In auditd, release the async flush lock on stop Don't allow auditd to log directly into /var/log when log_group is non-zero Cleanup krb5 memory leaks on error paths Update auditd.cron to use auditctl --signal In auparse, if too many fields, realloc array bigger (Paul Wolneykien) In auparse, special case kernel module name interpretation If overflow_action is ignore, don't treat as an error Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Fix compile error for audit_2.8.5Akash Hadke2022-10-213-2/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix below compile errors 1. Fix build with linux 5.17+ audit errors out due to swig munging it does with kernel headers | audit_wrap.c: In function '_wrap_audit_rule_data_buf_set': | audit_wrap.c:4701:17: error: cast specifies array type | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4701:15: error: invalid use of flexible array member | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4703:15: error: invalid use of flexible array member | 4703 | arg1->buf = 0; | | ^ These errors are due to VLAIS from kernel headers, so we copy linux/audit.h and make the needed change in local audit.h and make needed arrangements in build to use it when building audit package Take reference of upstream commit ee3c680c3 audit: Upgrade to 3.0.8 and fix build with linux 5.17+ Update 0002-Fixed-swig-host-contamination-issue.patch 2. Fix ipx.h missing file bug for kernel 5.15 ipx.h header file is removed in kernel 5.15 Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/net?id=6c9b40844751ea30c72f7a2f92f4d704bc6b2927 which is causing below error for system with kernel equal and higher than 5.15 | ../../git/auparse/interpret.c:48:10: fatal error: linux/ipx.h: No such file or directory | 48 | #include <linux/ipx.h> | | ^~~~~~~~~~~~~ Add below patch to fix this issue. 0001-Make-IPX-packet-interpretation-dependent-on-the-ipx-header.patch Link: https://github.com/linux-audit/audit-userspace/commit/6b09724c69d91668418ddb3af00da6db6755208c Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: fix the libpasswdqc FILES settingChen Qi2022-09-201-1/+1
| | | | | | | | | | The actual file name is now libpasswdqc.so.1 instead of libpasswdqc.so.0. This fixes the following error when installing passwdqc: nothing provides libpasswdqc needed by passwdqc-2.0.2-r0 Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: Upgrade to 2.0.2Khem Raj2022-09-072-12/+9
| | | | | | | License-Update: install-dependencies.sh and run-build-and-tests.sh are mentioned under GPL-2.0 but they are not included in release tarball Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Revert the tweak done in configure step in do_installKhem Raj2022-08-171-0/+2
| | | | | | | | | This tweak is needed for building audit but not the interfaces it may expose via the headers, therefore undo the tweak before packaging things up Reported-By: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Fix build with muslKhem Raj2022-08-102-0/+35
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Upgrade to 3.0.8 and fix build with linux 5.17+Khem Raj2022-08-082-11/+9
| | | | | | | | | | | | | | | | | | | | | | audit errors out due to swig munging it does with kernel headers | audit_wrap.c: In function '_wrap_audit_rule_data_buf_set': | audit_wrap.c:4701:17: error: cast specifies array type | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4701:15: error: invalid use of flexible array member | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4703:15: error: invalid use of flexible array member | 4703 | arg1->buf = 0; | | ^ These errors are due to VLAIS from kernel headers, so we copy linux/audit.h and make the needed change in local audit.h and make needed arrangements in build to use it when building audit package Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
* tomoyo-tools: Drop md5sumKhem Raj2022-04-251-1/+0
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tomoyo-tools: Define SBINDIRKhem Raj2022-04-251-1/+1
| | | | | | | default SBINDIR is hardcoded to /sbin which does not work when using usrmerge Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Upgrade 3.0.6 -> 3.0.7Alex Kiernan2022-04-181-2/+1
| | | | | | | | Dependency on bash has been removed upstream. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: package simplificationAnu Deepthika, Nandipati2022-03-291-8/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Add inital recipeAnu Deepthika, Nandipati2022-03-242-0/+181
| | | | | | | | | Set one crypto-backend library at a time OpenSSL is the crypto-backend library set for device hashing Override PACKAGECONFIG to replace it with libsodium or libgcrypt Signed-off-by: Anu Deepthika, Nandipati <Nandipati.AnuDeepthika@philips.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: Update LICENSE variable to use SPDX license identifiersKhem Raj2022-03-045-5/+5
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: Update SRC_URI branch and protocolsRichard Purdie2021-11-032-2/+2
| | | | | | | | | This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.5 -> 3.0.6Yi Zhao2021-10-191-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: fix install pathAlexander Thoma2021-10-141-12/+3
| | | | | | Signed-off-by: Alexander Thoma a.thoma@rational-online.com Signed-off-by: Florian Wühr f.wuehr@rational-online.com Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.4 -> 3.0.5Yi Zhao2021-08-192-134/+1
| | | | | | | Drop backported patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.3 -> 3.0.4Yi Zhao2021-08-112-1/+134
| | | | | | | Backport a patch to fix the wrong account associations issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: fix compile error for 2.8.5Yi Zhao2021-08-064-19/+110
| | | | | | | | | | | | | | * Backport a patch to fix the compile error * Refresh the patches to fix the patch-fuzz warning. * Minor tweaks to the recipe with reference to the 3.0 bb file. Fixes: tmp/work/core2-64-poky-linux/audit/2.8.5-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/11.1.1/ld: ausearch-checkpt.o:/usr/src/debug/audit/2.8.5-r0/build/src/../../git/src/ausearch-common.h:53: multiple definition of `event_node_list'; ausearch.o:/usr/src/debug/audit/2.8.5-r0/build/src/../../git/src/ausearch-common.h:53: first defined here Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Convert to new override syntaxMartin Jansa2021-08-037-40/+40
| | | | | | | | | | This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* audit: upgrade 3.0.2 -> 3.0.3Yi Zhao2021-08-031-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.1 -> 3.0.2Yi Zhao2021-07-081-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: migrate from meta-selinuxArmin Kuster2021-05-127-0/+586
| | | | | | | Move audit to a more common layer to simplify integration. Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: change shebang to python3Changqing Li2021-05-111-3/+5
| | | | | | | | upstream nmap is python2 compatiable now, but this recipe supports python3. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: update to 2.6.1 and alignakuster2021-02-172-18/+30
| | | | | | | | meta-security has this pkg to but newer. Move from meta-sec to meta-oe minor cleanups. Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: remove double modify operationKonrad Weihmann2020-05-311-1/+1
| | | | | | | | It is either += or append but not both - picking append to be the safe bet Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: make ndiff support python3Mingli Yu2020-02-153-2/+1778
| | | | | | | | | | The ndiff is python2 compatible now, backport a patch from debian to make ndiff port to python3. Refer to https://sources.debian.org/data/main/n/nmap/7.80+dfsg1-2/debian/patches/0004-Python3-port-of-ndiff.patch Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Use py3 in depends/rdependsKhem Raj2020-01-241-2/+2
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-oe: Remove using python2Khem Raj2020-01-221-1/+1
| | | | | | | This change makes the parsing go though, we still might have build issues, which will be reported in world builds seprately Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: upgrade 1.6 -> 1.6.1Mingde (Matthew) Zeng2020-01-151-2/+2
| | | | | Signed-off-by: Matthew Zeng <Matthew.Zeng@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: add recipeJan Luebbe2019-11-221-0/+18
| | | | | | | | | | This is useful for consolidation of code-signing interfaces when building an image with verified boot mechanisms or signed update artifacts. It can also be used on the target as a backend for software which uses the PKCS#11 API to access private key material. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: rename distro_features_check to features_checkDenys Dmytriyenko2019-11-211-1/+1
| | | | | | | Avoid warning due to the class rename in OE-Core. Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: Clarify BSD license variantChristophe PRIOUZEAU2019-10-251-1/+1
| | | | | | The License of passwdqc is BSD-1-Clause. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: Fix installed-vs-shipped for nativesdkRobert Yang2019-09-251-0/+12
| | | | | | | | | | | | | | | | | Fixed: $ bitbake nativesdk-keyutils ERROR: nativesdk-keyutils-1.6-r0 do_package: QA Issue: nativesdk-keyutils: Files/directories were installed but not shipped in any package: /usr /etc /usr/share /usr/share/man /usr/share/keyutils [snip] /etc/request-key.conf /etc/request-key.d Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Update to 7.80Peiran Hong2019-09-232-36/+31
| | | | | | | | | | | | | | | | Updates nmap to v7.80, this solves the following CVEs: - CVE-2017-18594 - CVE-2018-15173 and addressed numerous bugs as well. The patch '0001-include-time.h-for-time-structure-definition.patch' is modified to be applicable to the new version while serving for the same purpose. The license changed in the commit https://github.com/nmap/nmap/commit/d639a53 and is only a date bump without modification of any content in the license. Signed-off-by: Peiran Hong <peiran.hong@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Adapt to the lsb -> lsb-release change in OE-coreAdrian Bunk2019-08-291-1/+1
| | | | | Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: move recipe and patches from meta-security to meta-oeYongxin Liu2019-07-105-0/+167
| | | | | | | | keyutils is originally in https://git.yoctoproject.org/git/meta-security. Move it to meta-oe since other recipes in OE depend on it. Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 15:29:26 +0000