summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* dm-verity-img.bbclass: Fix bashismsniko.mauno@vaisala.com2020-10-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resort to printf in order to avoid usage of non-POSIX compliant echo flags. This mitigates following errors visible in console during boot-up with image that has been built on a host that symlinks '/bin/sh' to 'dash': /init: /usr/share/dm-verity.env: line 1: -NE_UUID: not found /init: /usr/share/dm-verity.env: line 2: -ne: not found /init: /usr/share/dm-verity.env: line 3: 642864e8-6a17-46b9-ba1e-9386a3909c8d: not found /init: /usr/share/dm-verity.env: line 4: -NE_HASH_TYPE: not found /init: /usr/share/dm-verity.env: line 5: -ne: not found /init: /usr/share/dm-verity.env: line 6: 1: not found /init: /usr/share/dm-verity.env: line 7: -NE_DATA_BLOCKS: not found /init: /usr/share/dm-verity.env: line 8: -ne: not found /init: /usr/share/dm-verity.env: line 9: 12064: not found /init: /usr/share/dm-verity.env: line 10: -NE_DATA_BLOCK_SIZE: not found /init: /usr/share/dm-verity.env: line 11: -ne: not found /init: /usr/share/dm-verity.env: line 12: 1024: not found /init: /usr/share/dm-verity.env: line 13: -NE_HASH_BLOCK_SIZE: not found /init: /usr/share/dm-verity.env: line 14: -ne: not found /init: /usr/share/dm-verity.env: line 15: 4096: not found /init: /usr/share/dm-verity.env: line 16: -NE_HASH_ALGORITHM: not found /init: /usr/share/dm-verity.env: line 17: -ne: not found /init: /usr/share/dm-verity.env: line 18: sha256: not found /init: /usr/share/dm-verity.env: line 19: -NE_SALT: not found /init: /usr/share/dm-verity.env: line 20: -ne: not found /init: /usr/share/dm-verity.env: line 21: 19d98185b42a897a37db6c56c7470ab2d455f0de46daa0df735eee6263816439: not found /init: /usr/share/dm-verity.env: line 22: -NE_ROOT_HASH: not found /init: /usr/share/dm-verity.env: line 23: -ne: not found /init: /usr/share/dm-verity.env: line 24: 298d75fc2ea27fe594b6a37158a6ae7538e77d918bab98c475934f625de0e4ab: not found Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit ad55aaca1be60f6c1b066782e7ee6f6f323ffbbf)
* sssd: Make manpages buildableJonatan Pålsson2020-10-162-1/+37
| | | | | | | | Some XML related fixes are needed to make the sssd manpages buildable Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 5efa53b2b2bab6f2d8589624c1700d1e66f29683)
* sssd: disable build secretsKai Kang2020-10-161-4/+3
| | | | | | | | | | | | | | | | | | | | It requires http_parser.h to build secrets: | configure: error: | You must have the header file http_parser.h installed to build sssd | with secrets responder. If you want to build sssd without secret responder | then specify --without-secrets when running configure. The header file is from package http-parser[1] rather than apache2. But there is no recipe http-parser in openembedded. So disable build secrets for sssd and remove related systemd service and socket files. Reference: 1. https://github.com/nodejs/http-parser Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 7831969f8caa399d88d49833800fafe7324b8a59)
* packagegroup-core-security: remove libseccomp for riscv*Armin Kuster2020-10-161-1/+1
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 29f47b44852122c5618e30037710dde009146eb5)
* libsecomp: rv32/rv64 target builds are not supported yetArmin Kuster2020-10-161-0/+3
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit b5a5cbe1f511468af0b0673f88c83c3dd1c77da3)
* packagegroup-core-security: remove clamav for riscv*Armin Kuster2020-10-161-3/+1
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 98ff502d4096331e2b8a8e4044860b23bf6f8ea5)
* packagegroup-core-security-ptest: update fail2ban ptest pkg nameArmin Kuster2020-10-161-1/+1
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit a2a102b2de68f31df5a3b46665c8afb2d28c0219)
* gitlab-ci: add support for dunfellArmin Kuster2020-10-1527-0/+428
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitignore addedAdrian2020-09-291-0/+7
| | | | | | | | After running testimage there are some python left overs at lib/oeqa/runtime/cases/__pycache__/ Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: update SO_VER to 9.0.4Charlie Davies2020-09-121-1/+1
| | | | | Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: add INSTALL_CLAMAV_CVD flag to do_installCharlie Davies2020-09-121-1/+3
| | | | | | | | | Recipe provides INSTALL_CLAMAV_CVD flag to bypass clamav cvd db creation. During do_install this flag should be used to conditionally skip install of cvd db if needed. Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: Several Security fixesArmin Kuster2020-08-242-0/+95
| | | | | | | | | | | | | | | | | | | Source: meta-security MR: 105088 Type: Security Fix Disposition: Backport from http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/commit/?id=787ba6faeaa8823a4d87e5edd15581cb4e12fa70 ChangeID: b55bccb002b9eb2c49dfe380406e2597bb1ade90 Description: Fixes: CVE-2020-24332 CVE-2020-24330 CVE-2020-24331 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 787ba6faeaa8823a4d87e5edd15581cb4e12fa70) Signed-off-by: Armin Kuster <akuster@mvista.com>
* packagegroup-security-tpm2: Depend on preferred provider for cryptsetupJeremy Puhlman2020-07-141-1/+2
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-devJeremy Puhlman2020-07-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | Without this we get weird conflict when you include dev packages: rror: Transaction check error: file /usr/include/libcryptsetup.h conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib64/libcryptsetup.so conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib64/pkgconfig/libcryptsetup.pc conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib/libcryptsetup.so conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib/pkgconfig/libcryptsetup.pc conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* bastille: Deleted redundant inherit to fix error when enable multilib.Zheng Ruoqin2020-07-141-2/+0
| | | | | | | | There is no need to inherit module-base. Because this inherit will stop bastille to build to lib32-bastille. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ccs-tools:Fix build error when enable multilib.Zheng Ruoqin2020-07-141-1/+1
| | | | | | | | | | | | ERROR: lib32-ccs-tools-1.8.4-r0 do_install: oe_runmake failed ERROR: lib32-ccs-tools-1.8.4-r0 do_install: Execution of '/build-armv8/tmp/work/armv7ahf-neon-mllib32-linux-gnueabi/lib32-ccs-tools/1.8.4-r0/temp/run.do_install.22368' failed with exit code 1: make: *** No rule to make target 'install'. Stop. WARNING: exit code 1 from a shell command. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* isafw.bbclass: typo in layer nameArmin Kuster2020-07-141-0/+0
| | | | | | move class to proper layer Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: pull in coreutils/findutils only when not using systemd as init ↵Alexander Kanavin2020-06-191-1/+2
| | | | | | | | | | | | manager The utilities from those packages (xargs, comm) are only used in sysvinit scripts, and so there is no need to pull them in when systemd is in use. Both are gpl3 licensed, so this is beneficial for builds where gpl3 is not allowed. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tripwire: Remove makefiles from the man directories.Jeremy Puhlman2020-06-191-0/+1
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: resolve multilib issuesJeremy Puhlman2020-06-191-1/+4
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: dnmalloc hash fix for aarch64 and mips64Haseeb Ashraf2020-05-151-1/+3
| | | | | | | | | | | | | | fix runtime error: samhain[4069]: FATAL: x_dnmalloc.c: 2790: hashval < AMOUNTHASH Killed The proper fix is not to disable dnmalloc. This change is in continuation of samhain-mips64-aarch64-dnmalloc-hash-fix.patch which requires CONFIG_ARCH_AARCH64 or CONFIG_ARCH_MIPS64 to be defined for the corresponding architecture Signed-off-by: Haseeb Ashraf <Haseeb_Ashraf@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain-server: add volatile file for systemdYi Zhao2020-05-153-4/+15
| | | | | | | | Add volatile file to create /var/log/yule when using systemd. Also remove unused /var/log directory in do_install. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: add a working example for BeagleBone BlackBartosz Golaszewski2020-05-154-0/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds various bits and pieces to enable generating a working example of a full chain of trust up to dm-verity-protected rootfs level on Beagle Bone Black. The new initramfs is quite generic and should work for other SoCs as well when using fitImage. The following config can be used with current master poky, meta-openembedded & meta-security to generate a BBB image using verified boot and dm-verity. UBOOT_SIGN_KEYDIR = "/tmp/test-keys/" UBOOT_SIGN_KEYNAME = "dev" UBOOT_SIGN_ENABLE = "1" UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" UBOOT_MACHINE_beaglebone-yocto = "am335x_boneblack_vboot_config" IMAGE_CLASSES += "dm-verity-img" IMAGE_FSTYPES += "wic.xz ext4" DM_VERITY_IMAGE = "core-image-full-cmdline" DM_VERITY_IMAGE_TYPE = "ext4" KERNEL_CLASSES += "kernel-fitimage" KERNEL_IMAGETYPE_beaglebone-yocto = "fitImage" IMAGE_INSTALL_remove = " kernel-image-zimage" IMAGE_BOOT_FILES_remove = " zImage" IMAGE_BOOT_FILES_append = " fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE};fitImage" # Using systemd is not strictly needed but deals nicely with read-only # filesystem by default. DISTRO_FEATURES_append = " systemd" DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "systemd-compat-units" INITRAMFS_IMAGE = "dm-verity-image-initramfs" INITRAMFS_FSTYPES = "cpio.gz" INITRAMFS_IMAGE_BUNDLE = "1" WKS_FILE = "beaglebone-yocto-verity.wks.in" KERNEL_FEATURES_append = " features/device-mapper/dm-verity.scc" Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* classes: provide a class for generating dm-verity meta-data imagesBartosz Golaszewski2020-05-151-0/+88
| | | | | | | | | | | | | | | | | | This adds a class that allows to generate conversions of ext[234] and btrfs partitions images with dm-verity hash data appended at the end as well as a corresponding .env file containing the root hash and data offset that can be stored in a secure location (e.g. signed fitImage) or signed and verified at run-time on its own. The class depends on two variables: DM_VERITY_IMAGE: defines the name of the main image (normally the one that is used with the bitbake command to build the main image) DM_VERITY_IMAGE_TYPE: defines exactly one type for which to generate the protected image. Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* buck-security: fix runtime issue with missing per moduleArmin Kuster2020-05-151-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: update to 2.13.4Jan Luebbe2020-04-071-1/+1
| | | | | Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix wrong executable permission on service fileJan Luebbe2020-04-071-1/+1
| | | | | | | | | This avoids "systemd[1]: Configuration file /lib/systemd/system/apparmor.service is marked executable. Please remove executable permission bits. Proceeding anyway." on boot. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* arpwatch: add new recipeArmin Kuster2020-03-276-0/+344
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: update LAYERSERIES_COMPAT for dunfellMartin Jansa2020-03-275-5/+5
| | | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add infopipe PACKAGECONFIGJonatan Pålsson2020-03-271-2/+3
| | | | | | | | | | | infopipe was previously on by default, so add it to the default PACKAGECONFIG. The systemd files are only installed when --with-infopipe is passed to configure, so conditionally add them to SYSTEMD_SERVICE. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add missing DEPENDS on janssonJonatan Pålsson2020-03-271-1/+1
| | | | | | | | | | | | | | | | | | | | When building with the curl PACKAGECONFIG, sssd will depend on the jansson library. Fixes the following error: | checking for JANSSON... no | checking jansson.h usability... no | checking jansson.h presence... no | checking for jansson.h... no | configure: error: | You must have the header file jansson.h installed to build sssd | with secrets and KCM responder. If you want to build sssd without these | responders then specify --without-secrets --without-kcm when running configure. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add missing files to SYSTEMD_SERVICEJonatan Pålsson2020-03-271-0/+2
| | | | | | | | | | | | | | | | These files are installed when the ssh or curl PACKAGECONFIGs are enabled. Fixes the following error: ERROR: sssd-1.16.4-r0 do_package: QA Issue: sssd: Files/directories were installed but not shipped in any package: /lib/systemd/system/sssd-kcm.socket /lib/systemd/system/sssd-kcm.service /lib/systemd/system/sssd-ssh.socket /lib/systemd/system/sssd-ssh.service Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add sudo PACKAGECONFIGJonatan Pålsson2020-03-271-3/+3
| | | | | | | | | | | sudo was previously on by default, so add it to the default PACKAGECONFIG. The systemd files are only installed when --with-sudo is passed to configure, so conditionally add them to SYSTEMD_SERVICE. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add autofs PACKAGECONFIGJonatan Pålsson2020-03-271-3/+3
| | | | | | | | | | | autofs was previously on by default, so add it to the default PACKAGECONFIG. The systemd files are only installed when --with-autofs is passed to configure, so conditionally add them to SYSTEMD_SERVICE. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Sort PACKAGECONFIG entriesJonatan Pålsson2020-03-271-9/+9
| | | | | Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* buck-security: move to recipes-scannersArmin Kuster2020-03-271-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* checksecurity: move to recipes-scannersArmin Kuster2020-03-273-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* checksec: move to recipe-scannersArmin Kuster2020-03-271-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: move to recipes-scannersArmin Kuster2020-03-279-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chkrootkit: add rootkit recipeArmin Kuster2020-03-271-0/+48
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslogArmin Kuster2020-03-271-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: add missing rdependsArmin Kuster2020-03-271-1/+1
| | | | | | add findutils Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap-daemon: add missing runtime dependenciesYi Zhao2020-03-271-1/+4
| | | | | | | | Add missing runtime dependencies otherwise /usr/bin/oscapd can not startup. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libseccomp: update to 2.4.3Armin Kuster2020-03-082-47/+1
| | | | | | dropped patch now included in update Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: python2 not supportedArmin Kuster2020-03-081-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: update the bbappend to 5.xAndré Draszik2020-03-081-0/+0
| | | | | | | | | | | | | | | As linux-yocto upgraded to 5.x in oe-core, update the bbappend to 5.x to remove the warning ERROR: No recipes available for: .../meta-security/meta-tpm/recipes-kernel/linux/linux-yocto_4.%.bbappend This patch hasn't been verified any further than allowing bitbake to complete with a non-linux-yocto kernel. In particular options could be different, or new ones needed / desired. Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: DEPEND on nss if nothing else is chosenJonatan Pålsson2020-03-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | sssd will attempt to build against nss if no crypto is selected. If a bbappend sets PACKAGECONFIG = <list without nss or crypto>, the appropriate DEPEND is not established. Fixes the following configure error: ... snip ... | checking for NSS... configure: error: Package requirements (nss) were not met: | | No package 'nss' found | | Consider adjusting the PKG_CONFIG_PATH environment variable if you | installed software in a non-standard prefix. | | Alternatively, you may set the environment variables NSS_CFLAGS | and NSS_LIBS to avoid the need to call pkg-config. | See the pkg-config man page for more details. | | WARNING: exit code 1 from a shell command. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Fix typo in PACKAGECONFIG. cyrpto -> cryptoJonatan Pålsson2020-03-081-1/+1
| | | | | Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Add PACKAGECONFIG for python2Jonatan Pålsson2020-03-081-0/+1
| | | | | | | | | | | | | | | | | Fixes the following build error: .. snip .. | checking for python2... no | checking for python3... (cached) python3.8 | configure: error: | The program python2 was not found in search path. | Please ensure that it is installed and its directory is included in the search | path. It is required for building python2 bindings. If you do not want to build | them please use argument --without-python2-bindings when running configure. | WARNING: exit code 1 from a shell command. Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: Add meta-python to list of layer depsJonatan Pålsson2020-03-051-0/+5
| | | | | Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>