summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* grub-efi: refresh patches to fix QA warningYi Zhao2018-05-103-13/+23
| | | | | | | | | Refresh the following patches: 0003-efi-chainloader-implement-an-UEFI-Exit-service-for-s.patch 0005-efi-chainloader-use-shim-to-load-and-verify-an-image.patch Grub-get-and-set-efi-variables.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-core: Move kernel-initramfs.bbappendTom Rini2018-05-061-0/+0
| | | | | | | As the main recipe resides in meta/recipes-core/images/ move the append to recipes-core/images/ as well for consistency. Signed-off-by: Tom Rini <trini@konsulko.com>
* kernel-initramfs: Rework to use update-alternatives directlyTom Rini2018-05-062-63/+39
| | | | | | | | | | | | | | - All valid initramfs types will be listed in INITRAMFS_FSTYPES so use that variable rather than open-coding a list of possibilities. - Since we're using the list of things that must exist now we don't need to test if the files exist anymore. And when signing, we can sign all of them now. - Add some python to do_package to update all of the ALTERNATIVES variables dynamically based on how we're configured. This introduces an alternative for the initramfs portion as well so there is a stable name. Signed-off-by: Tom Rini <trini@konsulko.com>
* efitools: Rework how we deal with rpath and linking of Linux appsTom Rini2018-05-023-30/+28
| | | | | | | | | | | | | | | | - In all cases, when building Linux apps (and thus linking with gcc) we need to pass in the normal set of LDFLAGS for both rpath and link hash type. - Rework Fix-for-the-cross-compilation.patch a bit. When linking EFI apps (and thus linking with ld) we don't need to pass in other special flags. When linking the "openssl" apps we do not need to spell out the crtN files as gcc handles that for us, they are normal Linux apps. Ensure that all Linux apps get our EXTRA_LDFLAGS passed in. With all of these changes we are now able to reuse sstate cache between build directories. Signed-off-by: Tom Rini <trini@konsulko.com>
* initrdscripts-secure-core: Provide all directories init requiresTom Rini2018-04-271-0/+6
| | | | | | | | Our "init" script requires additional directories to exist and since we don't pull in something like base-files that gives us a full layout we must make these additional directories on our own. Signed-off-by: Tom Rini <trini@konsulko.com>
* README: Clarify local.conf required changes for IMATom Rini2018-04-201-0/+2
| | | | | | | | | | - You must ensure that RPM is used in PACKAGE_CLASSES. - We need to remove image-prelink from USER_CLASSES. Prelinking the image at creation time (as happens on x86/x86_64) will result in the IMA hash of files changing from the recorded signature and verification will fail. Signed-off-by: Tom Rini <trini@konsulko.com>
* keyutils: refresh patches to fix QA warningYi Zhao2018-04-113-23/+26
| | | | | | | | | Refresh the following patches: keyutils-fix-the-cflags-for-all-of-targets.patch keyutils_fix_x86-64_cflags.patch keyutils_fix_x86_cflags.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* init.ima: Fix up the syntax errorJia Zhang2018-03-191-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* grub/boot-menu: Rename _bakup suffix to _backupJia Zhang2018-03-191-3/+3
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* ima/linux-yocto: Enable CONFIG_IMA_READ_POLICY and CONFIG_IMA_APPRAISE_BOOTPARAMJia Zhang2018-03-191-1/+2
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* integrity/linux-yocto: Enable CONFIG_SYSTEM_BLACKLIST_KEYRINGJia Zhang2018-03-191-0/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* init.ima: Fix the failure when importing the external policy from real rootfsJia Zhang2018-03-191-1/+3
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* README: Document the instruction to install kernel imageJia Zhang2018-03-191-0/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* cryptfs-tpm2: Update the upstream URLJia Zhang2018-03-131-2/+2
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* seloader: sync up with upstreamJia Zhang2018-02-281-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* meta-integrity: Ensure that we have CONFIG_SECURITY enabled in the kernelTom Rini2018-02-221-0/+1
| | | | | | | | To make it easier to use this layer with various BSP layers we need to ensure that we set CONFIG_SECURITY=y as that is in turn required by the rest of our features, except for CONFIG_SECURITYFS Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-secure-core: update TSS 2.0 to the latest stable versionJia Zhang2018-02-197-130/+80
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* meta-integrity: Fix build problem on ima-inspectTom Rini2018-02-171-1/+1
| | | | | | | The sources require that we have pkgconfig support as well, add missing inherit. Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-integrity: Add ima-inspect utilityTom Rini2018-02-162-0/+12
| | | | | | | | ima_inspect is a small program that allows to give a human-readable representation of the contents of the extended attributes (xattrs) that the Linux IMA security subsystem creates and manages for files. Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-integrity: Drop RPM patches that are upstream nowTom Rini2018-02-1412-796/+0
| | | | | | | | As of OE-Core rev b4613b6ce07c295c5d6de6861acf19315acaccb2 we are using rpm-4.14.0 as the base version. This includes all of the patches we had been applying. Signed-off-by: Tom Rini <trini@konsulko.com>
* kernel-initramfs: use oe.utils.read_fileJackie Huang2018-02-071-1/+1
| | | | | | | base_read_file has been removed from oe-core so use the replacement function oe.utils.read_file. Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
* efitools: use oe.utils.str_filter_outJackie Huang2018-02-071-2/+2
| | | | | | | oe_filter_out has been removed from oe-core so use the replacement function oe.utils.str_filter_out. Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
* util-linux: Fix package name extensionHolger Dengler2017-12-092-3/+3
| | | | | | | | | Yocto (pyro) uses the character "_" to separate the package name from the version number. If this character is used in the package name or in a package name extension, the build will fail. Replacing the "_" with one of the allowed characters fixes the problem. Signed-off-by: Holger Dengler <dengler@linutronix.de>
* README: update READMEJia Zhang2017-12-042-3/+12
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* linux-yocto: fix loading kernel module due to being strippedJia Zhang2017-11-261-0/+2
| | | | | | | | | The kernel module will be stripped during do_package, including the modsign signature. Use INHIBIT_PACKAGE_STRIP=1 if modsign is configured. Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* README.md: update to claim the support of modsignJia Zhang2017-11-211-1/+10
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-integrity: enable modsign support in kernelJia Zhang2017-11-213-5/+30
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-signing-key: support to build key-store with modsign and extra system ↵Jia Zhang2017-11-213-6/+120
| | | | | | trusted key support Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* scripts/create-user-key-store.sh: support to generate the user keys for ↵Jia Zhang2017-11-211-0/+26
| | | | | | modsign and extra system trusted key Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-signing-key: add the sample keys for modsign and extra system trusted keyJia Zhang2017-11-214-0/+94
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-signing-key, meta-efi-secure-boot: Rework for dependenciesTom Rini2017-11-1611-1/+1
| | | | | | | | | | | | The content of meta-signing-key depends on a few recipes within meta-efi-secure-boot. However, meta-signing-key can be used without meta-efi-secure-boot if we move libsign and sbsigntool over. Doing this will also provide a more correct set of dependencies as we cannot say that both layers depend on eachother. While doing this, within meta-signing-key only depend on content from meta-efi-secure-boot if the efi-secure-boot DISTRO_FEATURE is set. Signed-off-by: Tom Rini <trini@konsulko.com>
* README updateTom Rini2017-11-161-0/+1
| | | | | | Include what's required to have rpms be signed in the example section. Signed-off-by: Tom Rini <trini@konsulko.com>
* initrdscripts: rename expected ima certificate (#28)Yunguo Wei2017-11-121-1/+1
| | | | | | | | evmctl is able to import DER format certificate only. Although *.crt doesn't mean its a PEM certificate, but *.der makes more sense. Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* seloader: sync up with upstreamJia Zhang2017-10-271-1/+1
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* rpm: always include rpm-integrity.inc for RPM signingJia Zhang2017-10-271-1/+1
| | | | | | rpm-integrity is required for RPM signing which is enabled by default. Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-integrity: fix build failure caused by 6aa83f98bJia Zhang2017-10-271-1/+1
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* shim: drop fallbackJia Zhang2017-10-277-148/+7
| | | | | | | | | shim will uninstall MOK Verify Protocol when launching fallack, implying it is impossible to get the instance of MOK Verify Protocol for SELoader. This behavior violates the original intention of introducing fallback. Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* rpm: only apply bbappend file when ima in DISTRO_FEATURES (#27)Kai2017-10-272-22/+23
| | | | | | | | | | Rename bbappend file of rpm and only include it when image in DISTRO_FEATURES. Plugin 'systemd' of rpm-native causes warning during do rootfs: | WARNING: wrlinux-image-glibc-std-1.0-r5 do_rootfs: [log_check] wrlinux-image-glibc-std: found 1 warning message in the logfile: | [log_check] warning: Unable to get systemd shutdown inhibition lock: Socket name too long Signed-off-by: Kai Kang <kai.kang@windriver.com>
* shim: disable OVERRIDE_SECURITY_POLICY for 32bit target (#25)Wenzong Fan2017-09-301-1/+2
| | | | | | | | | | Fix 32bit assembler errors: | /tmp/ccJyZFtJ.s: Assembler messages: | /tmp/ccJyZFtJ.s:268: Error: bad register name `%rsp)' | /tmp/ccJyZFtJ.s:269: Error: bad register name `%rdi' ... | make[1]: *** [<builtin>: security_policy.o] Error 1 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* grub-efi: fix build error with qemux86 (#24)Wenzong Fan2017-09-291-1/+1
| | | | | | | | | Fix the error: mok2verify.c:169:53: error: \ format '%lx' expects argument of type 'long unsigned int', \ but argument 3 has type 'grub_efi_status_t {aka int}' \ [-Werror=format=] Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* keyutils: update to 1.5.10 (#22)Wenzong Fan2017-09-273-49/+57
| | | | | | | | | | | | | | | * rebase patches: - keyutils_fix_library_install.patch - keyutils-remove-m32-m64.patch * append '-Wall' to CFLAGS for fixing: .../recipe-sysroot/usr/include/features.h:376:4: error: \ #warning _FORTIFY_SOURCE requires compiling with \ optimization (-O) [-Werror=cpp] * cleanup alternative targets, the *keyring*.7 files have been removed from keyutils 1.5.10. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* user-key-store.bbclass: add deploy_rpm_keys (#20)Wenzong Fan2017-09-251-0/+10
| | | | | | Fix warning: WARNING: xxx do_sign: Function deploy_rpm_keys doesn't exist Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* Install packages if distro flag set (#21)Wenzong Fan2017-09-252-3/+3
| | | | | | | * install 'packagegroup-tpm2-initramfs' of distro flag 'tpm2' is set * install 'initrdscripts-ima' if distro flag 'ima' is set * install 'cryptfs-tpm2-initramfs' if distro flag 'luks' is set Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* cryptsetup:add lvm2-udevrules into RDEPENDS (#19)WarrickJiang2017-09-251-1/+1
| | | | | | meta-oe layer split the udevrules for lvm2 into a new package. Add lvm2-udevrules into cryptsetup RDEPENDS list. Signed-off-by: Jiang Lu <lu.jiang@windriver.com>
* kernel-initramfs: fix the issue rm kernel source codes (#18)fli2017-09-251-1/+0
| | | | | | | The "${S}" is not used for kernel-initramfs and it will cleanup the kernel source codes if it is specified to ${STAGING_KERNEL_DIR}, thus remove this definition. Signed-off-by: Fupan Li <fupan.li@windriver.com>
* meta-tpm2: clean up bootstrapJia Zhang2017-09-203-3/+3
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* Change the email address of MAINTAINERJia Zhang2017-09-201-1/+1
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* packagegroup-tpm: include tpm-quote-tools (#17)Wenzong Fan2017-09-121-0/+1
| | | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* meta-secure-core: clean up ${COREBASE}/LICENSE and ${COREBASE}/meta/COPYING.MITJia Zhang2017-09-0210-15/+10
| | | | | | | | ${COREBASE}/LICENSE is not a valid license file. So it is recommended to use '${COMMON_LICENSE_DIR}/MIT' for a MIT License file in LIC_FILES_CHKSUM. This will become an error in the future. Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* tpm : openssl-tpm-engine: parse an encrypted TPM key password from env (#15)limeng-linux2017-09-022-7/+285
| | | | | | | | | | | | | | when openssl-tpm-engine lib is used on an unattended device, there is no way to input TPM key password. So add this feature to support parse an encrypted(AES algorithm) TPM key password from env. The default decrypting AES password and salt is set in bb file. When we create a TPM key(TSS format), generate a 8 bytes random data as its password, and then we need to encrypt the password with the same AES password and salt in bb file. At last, we set a env as below: export TPM_KEY_ENC_PW=xxxxxxxx "xxxxxxxx" is the encrypted TPM key password for libtpm.so. Signed-off-by: Meng Li <Meng.Li@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-29 05:08:04 +0000