summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kas/kas-security-base.yml: update to honisterhonisterArmin Kuster2021-11-051-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes: Update SRC_URI branch and protocolsArmin Kuster2021-11-0433-33/+33
| | | | | | | | | This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 7e27eb5fca7a22e82251f79103bb12d2b70307fb)
* sssd: re-package to fix QA issuesKai Kang2021-10-181-5/+9
| | | | | | | | | | | | | | | | | | | | | | | It packages all file in ${libdir} to package sssd, including the .so symlink files. Then it causes QA issues: | ERROR: QA Issue: sssd rdepends on dbus-dev [dev-deps] | ERROR: QA Issue: sssd rdepends on ding-libs-dev [dev-deps] So re-package sssd then the .so symlink files and .pc files are packaged to sssd-dev which should be. File ${libdir}/libsss_sudo.so is not a symlink file but packaged to sssd-dev too. Then causes another QA issue: | ERROR: sssd-2.5.2-r0 do_package_qa: QA Issue: -dev package sssd-dev contains non-symlink .so '/usr/lib/libsss_sudo.so' [dev-elf] So create a new sub-package libsss-sudo to package file libsss_sudo.so and make sssd rdepends on it. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fail2ban: fix build failure and cleanupArmin Kuster2021-10-182-178/+4
| | | | | | | | | | | | | Fixes: error in fail2ban setup command: use_2to3 is invalid. ERROR: 'python3 setup.py build ' execution failed. drop custom fail2ban_setup.py remove pyhton-fail2ban as its a symlink to python3 Update to tip for 11.2 branch Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes-security/chipsec: platform security assessment frameworkLiwei Song2021-10-181-0/+35
| | | | | | | | Add chipsec, tools to dump and analyzing hardware, system firmware components, like PCH register, ioport or iomem configuration space. Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update to 0.6.1Kristian Klausen2021-10-182-21/+14
| | | | | | | | | | | | | | | | | swtpm no longer depends on Python[1] so the dependencies have been removed. "inherit perlnative" has been added due to (in oe-core): deda455b3c ("bitbake.conf: drop pod2man from hosttools") Some leftover dependencies have also been removed, ex: tpm-tools required in the past by swtpm_setup.sh (<0.4.0)[2]. [1] https://github.com/stefanberger/swtpm/issues/437 [2] https://github.com/stefanberger/swtpm/commit/eee8cb5dfb13f87140dddda38f65bf61aff19508 Signed-off-by: Kristian Klausen <kristian@klausen.dk> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Upgrade parsec-service 0.8.1 and parsec-tool 0.4.0Anton Antonov2021-09-287-295/+477
| | | | | Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: update to 0.8.7Kristian Klausen2021-09-281-1/+1
| | | | | Signed-off-by: Kristian Klausen <kristian@klausen.dk> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: Set clamav:clamav ownership on /var/lib/clamav in do_installZoltán Böszörményi2021-09-281-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, rearrange the runtime-dependencies a little so clamav-freshclam is installed later than clamav. The issue is that clamav-freshclam ships /var/lib/clamav and the main clamav package uses chown in pkg_postinst to set the ownership of this directory. But pkg_postinst is not marked as "ontarget" so this chown only took effect when upgrading or reinstalling the package. So when clamav is part of an OS image out of the box, freshclamd cannot populate this directory since it's running under the clamav user. Fix this by creating /var/lib/clamav with the proper ownership in do_install and rearrange runtime-dependencies, so clamav-freshclam RDEPENDS on clamav and clamav relaxes its runtime-dependency into RRECOMMENDS so clamav-freshclam is installed later than clamav, avoiding these warnings: Installing : clamav-freshclam-... 487/1954 warning: user clamav does not exist - using root warning: group clamav does not exist - using root Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dmverity: Make use of DATA_BLOCK_SIZE variable in initrdscript.Christer Fletcher2021-09-281-1/+2
| | | | | | | | | DATA_BLOCK_SIZE variable was set in dm-verity-img.bbclass at build time but the initrdscript was not updated to pass the DATA_BLOCK_SIZE to the veritysetup. Now the functionality is complete. Signed-off-by: Paulo Neves <paulo.neves1@inter.ikea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes-security/fscrypt: Add fscrypt .bb fileBhupesh Sharma2021-09-281-0/+49
| | | | | | | | | | | | fscrypt is a high-level tool for the management of Linux filesystem encryption. fscrypt manages metadata, key generation, key wrapping, PAM integration, and provides a uniform interface for creating and modifying encrypted directories. Add recipe for the same in 'recipes-security'. Signed-off-by: Bhupesh Sharma <bhupesh.sharma@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chkrootkit: update to 0.55Armin Kuster2021-09-281-2/+1
| | | | | | | | | | changes: Umbreon Linux Rootkit detection Kinsing.A Backdoor RotaJakito Backdoor Minor bug fixes Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm-quote-tools: Update SRC_URIArmin Kuster2021-09-161-4/+3
| | | | | | The wget now asks for user info so git clone. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* isic: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-2-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* checksec: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-3-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opendnssec: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-2-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-2-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmtpm2tss: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-2-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: set precise BSD licenseArmin Kuster2021-09-151-1/+1
| | | | | | "BSD" is ambiguous, use the precise licenses BSD-3-Clause Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryfs: drop recipeArmin Kuster2021-09-151-10/+0
| | | | | | it was accidently pushed and is incmomplete Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: 2.5.1 -> 2.5.2Kai Kang2021-09-102-1/+290
| | | | | | | | | | | | | | | | | | | | | | | | | | | SSSD 2.5.2 Highlights * General information - originalADgidNumber attribute in the SSSD cache is now indexed * New features - Debug messages in data provider include a unique request ID that can be used to track the request from its start to its end (requires libtevent >= 0.11.0) * Important fixes - Update large files in the files provider in batches to avoid timeouts * Configuration changes - Add new config option fallback_to_nss Full release notes: * https://sssd.io/release-notes/sssd-2.5.2.html And backport patch to fix CVE-2021-3621. CVE: CVE-2021-3621 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: Expose --data-block-size for configurationChrister Fletcher2021-09-061-1/+4
| | | | | | | | | | Add DM_VERITY_IMAGE_DATA_BLOCK_SIZE to be able to set the --data-block-size used in veritysetup. Tuning this value effects the performance and size of the resulting image. Signed-off-by: Christer Fletcher <christer.fletcher@inter.ikea.com> Signed-off-by: Paulo Neves <paulo.neves1@inter.ikea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: Fix typosGeorge Liu2021-08-291-1/+1
| | | | | | | | | Fix the variable spelling errors s/SKIP_META_SECUIRTY_SANITY_CHECK/SKIP_META_SECURITY_SANITY_CHECK Signed-off-by: George Liu <liuxiwei@inspur.com> Acked-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: remove rust layersArmin Kuster2021-08-272-10/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* harden-image-minimal: fix useradd inheritArmin Kuster2021-08-261-5/+6
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: drop meta-rustArmin Kuster2021-08-261-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: drop dynamic-layerArmin Kuster2021-08-261-4/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: rust is in coreArmin Kuster2021-08-269-0/+0
| | | | | | drop dynamic-layer Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krill: Rust is in core nowArmin Kuster2021-08-263-0/+0
| | | | | | drop dynamic-layer Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: more overided fixupsArmin Kuster2021-08-261-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: kernel-modsign: Change weak default valueDaiane Angolini2021-08-261-1/+1
| | | | | | | | Assign a weak default value for MODSIGN_KEY_DIR so the other layers can set a default value for them as well. Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: fix mailing lists and a typoMarta Rybczynska2021-08-261-4/+4
| | | | | | | | | | A number of typo fixes: - tmp->tpm in the DISTRO_FEATURES - update the mailing list address as it was out of date - update the distro name in the subject Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: fix mailing listsMarta Rybczynska2021-08-261-3/+3
| | | | | | | | The address included in the meta-hardening documentation does not work and was changed in other places in 2019. Signed-off-by: Marta Rybczynska <rybczynska@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: fix DISTRO appendsArmin Kuster2021-08-262-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-bas: bump conf valueArmin Kuster2021-08-261-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryfs: add new packageArmin Kuster2021-08-261-0/+10
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security.bb: only include suricat-ptest if rust is includedArmin Kuster2021-08-011-2/+13
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update to honisterMartin Jansa2021-08-017-7/+7
| | | | | | | This marks the layers as compatible with honister now they use the new override syntax. Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* kas: Convert to new override syntaxArmin Kuster2021-08-015-8/+8
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dynamix-layers: Convert to new override syntaxArmin Kuster2021-08-014-12/+12
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security-compliance: Convert to new override syntaxArmin Kuster2021-08-015-15/+15
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-parsec: Convert to new override syntaxArmin Kuster2021-08-012-9/+9
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security-isafw: Convert to new override syntaxArmin Kuster2021-08-012-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-hardening: Convert to new override syntaxArmin Kuster2021-08-018-11/+11
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Convert to new override syntaxArmin Kuster2021-08-0115-28/+28
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-tpm: Convert to new override syntaxArmin Kuster2021-08-0117-106/+106
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security: Convert to new override syntaxArmin Kuster2021-08-0149-641/+787
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: fix branch name and updateArmin Kuster2021-07-284-10/+10
| | | | | | | They dropped the dev branch for rel. Update to tip. Refresh patches Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krill: Add new pkgArmin Kuster2021-07-283-0/+380
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci.yml: streamline builds matrixArmin Kuster2021-07-285-74/+0
| | | | | | | drop ppc32 builds drop multi builds Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 02:19:13 +0000