summaryrefslogtreecommitdiffstats
path: root/meta-integrity
Commit message (Collapse)AuthorAgeFilesLines
* meta-secure-core: fix wrong operator combinationYi Zhao2021-11-183-3/+3
| | | | | | | | Operations like XXX:append += "YYY" are almost always wrong and this is a common mistake made in the metadata. Improve them to use the standard format. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* recipes: update SRC_URI branch and protocolsYi Zhao2021-11-151-1/+1
| | | | | | | Update SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* rpm-native: disable audit pluginChangqing Li2021-11-121-1/+1
| | | | | | | enable this plugin will cause undeterministic build. whether to build audit plugin depends on whether libaudit exists on the host Signed-off-by: Changqing Li <changqing.li@windriver.com>
* layer.conf: add back append to BB_HASHBASE_WHITELISTChen Qi2021-08-161-1/+1
| | | | | | | | Add back the append override, as the '+=' operator will make the default value of BB_HASHBASE_WHITELIST in oe-core not have any effect. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* layer.conf: add honister to LAYERSERIES_COMPATYi Zhao2021-08-091-1/+1
| | | | | | Drop other releases since they are not compatible anymore. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-secure-core: Convert to new override syntaxYi Zhao2021-08-0913-29/+29
| | | | | | Converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* layer.conf: add hardknott to LAYERSERIES_COMPATYi Zhao2021-04-211-1/+1
| | | | | | Remove other releases since they are not compatible anymore. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* conf/layer.conf: Add gatesgarth to LAYERSERIES_COMPATBartłomiej Burdukiewicz2020-12-091-1/+1
| | | | Signed-off-by: Bartłomiej Burdukiewicz <bartlomiej.burdukiewicz@gmail.com>
* rpm: apply signatures to config filesYi Zhao2020-12-082-0/+10
| | | | | | | | | Since rpm 4.15, the users can control over the installation of signatures on config files through a variable named %_ima_sign_config_files. But this is disabled by default. Add a macro configuration file to enable it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* ima: Fix badly formatted CONFIG_IMA_NG_TEMPLATEYongxin Liu2020-10-121-1/+1
| | | | | | | | | | Fix the following warning: [INFO]: the following symbols were not found in the active configuration: - CONFIG_IMA_NG_TEMPLATE=y Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
* conf/layer.conf: Add dunfell to LAYERSERIES_COMPATChristophe Priouzeau2020-05-271-1/+1
| | | | Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com>
* sign_rpm_ext: Use socket redirection to avoid GPG_PATH length limitationOvidiu Panait2020-03-011-5/+0
| | | | | | | | | | | | | | | Currently, an error will be thrown when trying to use a GPG homedir whose path length exceeds 80 characters. This limitation can be worked around by providing libassuan socket redirection files for "S.gpg-agent.yocto-native", "S.gpg-agent.ssh", "S.gpg-agent.browser" and "S.gpg-agent.extra" sockets. The redirection files will point to the real sockets in /tmp directory. The sockets will be automatically cleaned up by gpg agent. References: [1] https://dev.gnupg.org/T1752 [2] https://gnupg.org/documentation/manuals/assuan.pdf Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* ima-inspect: upgrade 0.11 -> 0.13Yi Zhao2020-01-192-15/+1
| | | | | | | | | Fixes: * Use glibc header instead of libattr header because the attr/xattr.h has been removed from attr package. * fix configure check for newer libimaevm versions. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* rpm-integrity: Use _append for PACKAGECONFIGOvidiu Panait2019-12-131-1/+3
| | | | | | | | | | Currently, the PACKAGECONFIG assignment in rpm-integrity might overwrite the previous contents of the variable. Similar to systemd_%.bbappend and ovmf_%.bbappend, use _append to add "imaevm" to PACKAGECONFIG when distro feature ima is enabled. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* sign_rpm_ext.bbclass: check the length of GPG_PATHLiwei Song2019-12-051-0/+4
| | | | | | | connect to gpg agent may failed due to the GPG_PATH is too long, check and raise an error if the length is greater than 80. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* sign_rpm_ext.bbclass: remove prefuncs for do_package_write_rpm andChangqing Li2019-11-291-3/+0
| | | | | | | | | do_rootfs in commit 393b80fa, prefuncs of do_package_write_rpm/do_rootfs have been replace by (task)_prepend in this bbclass, so remove it. Signed-off-by: Changqing Li <changqing.li@windriver.com>
* sign_rpm_ext.bbclass, user-key-store.bbclass: Add boot loader signingJason Wessel2019-11-081-24/+6
| | | | | | | | | | | | | | | | | | | | | This changes the rpm signing setup to use a generic routine check_gpg_key(), in order that the boot loader gpg signing can use the same infrastructure. For now the boot loader gpg signing will only support grub and introduces the variable: GRUB_SIGN_VERIFY = "1" This variable is a control point to activate the code in grub-efi to perform file verification of any file it loads against a gpg key which is linked into the boot loader with grub-mkimage. It will also cause all the other files such as the kernel, initramfs and LockDown.efi to be signed such that grub will verify the files. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sign_rpm_ext.bbclass: fix check_rpm_public_key failed while host not install ↵Sandy2019-11-071-4/+11
| | | | | | | | | | gpg (#124) Due to the following reasons, need to add the dependency to task who needs to run check_rpm_public_key: * packagegroup recipe don't have task prepare_recipe_sysroot * varflags depends don't work for prefuncs Signed-off-by: Changqing Li <changqing.li@windriver.com>
* sign_rpm_ext.bbclass: fix compile fail since missing gpg (#123)Sandy2019-11-061-0/+3
| | | | | | | | | | | | | | there is a scenario that this bbclass is enabled globally, all targets will inherit sign_rpm_ext. but this bbclass need gpg to work, on some new distro like ubuntun 19.04, gpg is not installed, so compile will failed. fail cmd: cmd = '%s --batch --homedir %s --passphrase %s --import %s' % \ (gpg_bin, gpg_path, d.getVar('RPM_GPG_PASSPHRASE', True), gpg_key) error: base-files-3.0.14-r89 do_package_write_rpm: Failed to import gpg key (): /bin/sh: 1: --batch: not found Signed-off-by: Changqing Li <changqing.li@windriver.com>
* conf/layer.conf: Add zeus to LAYERSERIES_COMPAT (#121)muvarov2019-11-011-1/+1
| | | Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
* lib-evm-utils: using the correct algo for v2 signature (#120)Yunguo Wei2019-10-102-0/+27
| | | | | | | | | | | | | | | | | | | | When using rpmsign (with --signfiles --fskpath) to sign RPM package, the IMA signature is not correct, see: $ getfattr -d -m - rootfs/usr/sbin/grpconv file: rootfs/usr/sbin/grpconv security.ima=0sAwIEDy1SEQP3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== And the expected signature is like this: $ getfattr -d -m - rootfs/usr/sbin/grpconv file: rootfs/usr/sbin/grpconv security.ima=0sAwIEDy1SEQEAA6s8DwmRCVutcrE8NvHWWYXlg8L1AwH5teu44prkKRwmhZQ52Oa4UQoZZlxER/SJ9tijbve8ZAv++KW8EqgP4iZjEGh8ke76rpiRU5glnG/U+HUjnilJBpzpMJHxyNbAiFoHMESeCOtrhY0zZIUXK3DnIuIJSwpfl2HaNFxRrE38EaqgV9IQ8QiWFCvgDYXoJDwc3KdhjKjs214tCfZpKO1w4QJl2n4llZHw2RTHIuUOsMhRDEXs6onLHmdmhvqgxIHt7IvsT9v7H8GnoaiX0xgzxk2o/mE5EtPrnMtUoGSQwdY8CAfUbCwAp0c5QlsrHk5RBmewjJ/jxd/K1uKp7w== The root cause is libimaevm doesn't retrieve correct signing algo, so this patch is making things right. Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* linux-yocto-integrity.inc: fix 'uks_modsign_keys_dir' is not defined (#119)Hongxu Jia2019-10-071-2/+6
| | | | | | | | | | Since commit [b41010c linux-yocto-integrity: fix modsign key path] applied, if MODSIGN_ENABLED is "0", bbclass user-key-store will not be inherited which causing 'uks_modsign_keys_dir' is not defined Unconditionally inherit user-key-store, but conditionally invoke uks_modsign_keys_dir Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* meta-integrity: fix documentationDmitry Eremin-Solenikov2019-09-301-4/+5
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* linux-yocto-integrity: fix modsign key pathDmitry Eremin-Solenikov2019-09-161-1/+3
| | | | | | | Use modsign key directly from uks_modsign_keys_path(d), rather than from installed package. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* packagegroup-ima: RRECOMMEND certificates rather than private keysDmitry Eremin-Solenikov2019-09-161-2/+2
| | | | | | Do not even try pulling private keys into rootfs. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* ima-inspect: add patch to fix compilation with newer ima-evm-utilsDmitry Eremin-Solenikov2019-09-042-1/+17
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* ima-evm-utils: update to release 1.2.1Dmitry Eremin-Solenikov2019-09-043-307/+7
| | | | | | Bump ima-evm-utils to latest release (1.2.1). Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* meta-secure-core: use bb.fatal instead of bb.build.FuncFailedYi Zhao2019-08-191-4/+2
| | | | | | | The bb.build.FuncFailed had been removed in bitbake with commit cfeffb602dd5319f071cd6bcf84139ec77f2d170. Use bb.fatal instead of it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-secure-core: add linux-yocto-dev bbappendYi Zhao2019-08-131-0/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto: upgrade bbappend from 4.% to 5.%Yi Zhao2019-08-132-0/+0
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* keyutils: remove itChangqing Li2019-08-026-204/+0
| | | | | | | | keyutils under meta-security have been moved to meta-openembeded by this commit https://git.openembedded.org/meta-openembedded/commit/?id=415e213ad75ec9a93171c963395a1c4b92c6233b and is higher version than keyutils, so remove this one Signed-off-by: Changqing Li <changqing.li@windriver.com>
* util-linux: only apply the bbappend if ima distro flag setYi Zhao2019-06-262-19/+20
| | | | | | | | | | | | | | | | Run yocto-check-layer-wrapper to check layer compliance of Yocto will report the signatures error: util-linux:do_compile: 9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374 -> 53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99 bitbake-diffsigs --task util-linux do_compile --signature 9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374 53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99 Rename util-linux_%.bbappend to util-linux-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* Revert "rpm: always include rpm-integrity.inc for RPM signing"Yi Zhao2019-06-261-1/+1
| | | | | | | | | | | | | | | | This reverts commit 0477a93cf98bd2946320d90cadb54a0fc2c2c0df. Run yocto-check-layer-wrapper to check layer compliance of Yocto will report the signatures error: rpm-native:do_configure: c2221ee127ea61f99a6062ffadb1fe05ca44b9200e38a91521a5a28d4f13140b -> d955da8ce20c8dbc0c5bc9b7569dd459484b0e24ba1e4c66828a84e919025eca bitbake-diffsigs --task rpm-native do_configure --signature c2221ee127ea61f99a6062ffadb1fe05ca44b9200e38a91521a5a28d4f13140b d955da8ce20c8dbc0c5bc9b7569dd459484b0e24ba1e4c66828a84e919025eca Revert the patch to fix it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-integrity/conf/layer.conf: add opemembedded-layer as layer dependencyYi Zhao2019-06-211-0/+1
| | | | | | | | | | | | | Fix ima-inspect build failure: $ bitbake ima-inspect ERROR: Nothing PROVIDES 'tclap' (but /build/poky/meta-secure-core/meta-integrity/recipes-support/ima-inspect/ima-inspect_0.11.bb DEPENDS on or otherwise requires it). ERROR: Required build target 'ima-inspect' has no buildable providers. Missing or unbuildable dependency chain was: ['ima-inspect', 'tclap'] Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* conf/layer.conf: Add warrior to LAYERSERIES_COMPATYi Zhao2019-04-231-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* Patch ima-evm-utils to fix build with muslLuca Boccassi2019-02-282-0/+38
| | | | | | | | Third party programs including libimaevm fails to build with musl due to a missing include in the public header. Add it. The build with glibc is unaffected. Patch sent upstream. Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
* base-files: only apply the bbappend if ima distro flag setYi Zhao2018-12-032-5/+6
| | | | | | | | | | | | | | When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* key-store: rename ima private key and certificate on targetYunguo Wei2018-11-073-3/+16
| | | | | | | | | If sample keys are selected, key-store service will deploy IMA private key during first boot, but beople may be confused if we deploy a sample private key like "xxx.crt", so this commit is making sure key/cert on target are consistent with key files on build system. Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* rpm: disable inhibit plugin for rpm-nativeChen Qi2018-10-171-0/+1
| | | | | | | | | | | | | | | We have a bbappend file which enables plugins for rpm. We need to ensure to also disable the inhibit plugin for rpm-native. Otherwise, we get the following warning at rootfs time. Unable to get systemd shutdown inhibition lock: Socket name too long The inhibit plugin tries to inhibit shutdown during rpm operation. It obviously makes no sense for rpm-native, as 1) we may not build on a systemd based host and 2) the build process does not affect the package management on host. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'Hongxu Jia2018-10-081-1/+1
| | | | | | | | Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Clean up the stuffs for stable branchesJia Zhang2018-09-2013-798/+1
| | | | | | | | | | | The following commits are reverted by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because they are only applicable to rocko. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* meta-integrity: rpm: Add back in required patches for rockoTom Rini2018-07-3112-0/+797
| | | | | | | | | | In 59a9f43b899c ("meta-integrity: Drop RPM patches that are upstream now") we removed patches to RPM that were not required with a move up to 4.14.0 as they are upstream. However, rocko ships with an older version of RPM and still needs these patches. Add conditional logic to apply these patches only for rocko. Signed-off-by: Tom Rini <trini@konsulko.com>
* layer.conf: Mark as compatible with rockoTom Rini2018-07-251-1/+1
| | | | | | | As we also work with the 'rocko' release list that in our LAYERSERIES_COMPAT. Signed-off-by: Tom Rini <trini@konsulko.com>
* util-linux: allow -static linking for switch_root.staticJoe Slater2018-07-061-1/+3
| | | | | | | Specify -no-pie to override possible -pie default. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* sign_rpm_ext.bbclass: fix check_rpm_public_key racing at recipe parsing timeHongxu Jia2018-05-311-4/+1
| | | | | | | | | | | | | | | | All recipe will be parsed which caused lockfile of check_rpm_public_key racing issue. ... |WARNING: meta-secure-core/meta/recipes-core/images/secure-core-image-initramfs.bb: oe-core/bitbake/lib/bb/utils.py:400: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmp-glibc/check_rpm_public_key.lock' mode='a+' encoding='UTF-8'> ... Refer do_package_write_rpm, add check_rpm_public_key to prefunc of do_rootfs, only the running image recipe will invoke check_rpm_public_key. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* layer.conf: add LAYERSERIES_COMPATTrevor Woerner2018-05-261-0/+2
| | | | | | see https://patchwork.openembedded.org/patch/140542/ Signed-off-by: Trevor Woerner <twoerner@gmail.com>
* sign_rpm_ext.bbclass: check rpm public key at image recipe parsing timeHongxu Jia2018-05-231-0/+4
| | | | | | | | | | | | | | | | | While multiple builds share a common sstate, the latter build failed to build image which the public key not found. ... |ERROR: initramfs-ostree-image-1.0-r0 do_rootfs: Importing GPG key failed. Command 'rpmkeys --root=<path>/rootfs --import <path>/rpm-key' returned 1: ... The latter build will not regenerate rpm packages and check_rpm_public_key will not be invoked. Explicitly invoke check_rpm_public_key at image recipe parsing time, which make sure gpg public key be imported. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* meta-integrity, meta-signing-key: Populate the secondary keyringTom Rini2018-05-171-0/+13
| | | | | | | | | | | | Currently we provide a secondary trusted key that is signed by the primary key. We do not however DER encode this certificate. Update the key-store recipe to also make a DER encoding of this certificate and include it in the same package as the PEM version of the certificate. In the IMA init script, if we have any secondary certificate in a DER encoding, load them into the secondary keyring before we try and load the IMA keys. Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-integrity: init.ima: Switch to using keyctlTom Rini2018-05-172-3/+5
| | | | | | | | | Rather than parse /proc/keys directly to find out the ID of the keyring that we're using, let keyctl do this for us. In order to do that we need to have /proc available as /proc, so move it around before and after working with keyctl. Signed-off-by: Tom Rini <trini@konsulko.com>
* keyutils: refresh patches to fix QA warningYi Zhao2018-04-113-23/+26
| | | | | | | | | Refresh the following patches: keyutils-fix-the-cflags-for-all-of-targets.patch keyutils_fix_x86-64_cflags.patch keyutils_fix_x86_cflags.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-01 10:58:11 +0000