summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* samhain: Adapt test output to Automake format for ptest compatibilitymaster-nextHaixiao Yan9 hours2-0/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert CuTest output to follow Automake-compatible format (PASS:/FAIL:) so that ptest-runner can correctly parse and report test results. root@qemux86-64:~# ptest-runner samhain-standalone -t 3600 START: ptest-runner 2025-07-06T09:38 BEGIN: /usr/lib64/samhain-standalone/ptest PASS: Test_quote_string_ok PASS: Test_unquote_string_ok PASS: Test_csv_escape_ok PASS: Test_tiger PASS: Test_tiger_file PASS: Test_tiger_file_with_length PASS: Test_sh_tools_safe_name_01 PASS: Test_sh_tools_safe_name_02 PASS: Test_sh_tools_safe_name_03 PASS: Test_sh_tools_safe_name_04 PASS: Test_sh_tools_safe_name_05 PASS: Test_sh_tools_safe_name_06 PASS: Test_sh_tools_safe_name_07 PASS: Test_is_numeric_01 PASS: Test_dnmalloc PASS: Test_sh_unix_lookup_page PASS: Test_sl_strlcpy PASS: Test_sl_strlcat PASS: Test_sh_util_acl_compact PASS: Test_sh_util_strdup_ok PASS: Test_sh_util_strconcat_ok PASS: Test_sh_util_base64_enc_ok PASS: Test_sh_util_dirname_ok PASS: Test_sh_util_basename_ok PASS: Test_sh_util_utf8_ok PASS: Test_sh_util_obscure_ok PASS: Test_sl_stale PASS: Test_sl_snprintf PASS: Test_sl_ts_strncmp PASS: Test_sl_strcasecmp PASS: Test_zAVLTree PASS: Test_sha256 PASS: Test_entropy PASS: Test_fifo PASS: Test_file_lists PASS: Test_file_dequote PASS: Test_uuid PASS: Test_ignore_ok PASS: Test_inotify PASS: Test_ipvx PASS: Test_login PASS: Test_login PASS: Test_portcheck_lists PASS: Test_processcheck_watchlist_ok PASS: Test_processcheck_listhandle_ok PASS: Test_restrict PASS: Test_cmdlist PASS: Test_srp PASS: Test_string DURATION: 0 END: /usr/lib64/samhain-standalone/ptest 2025-07-06T09:38 STOP: ptest-runner TOTAL: 1 FAIL: 0 root@qemux86-64:~# Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* suricata: fix "interface" arg in systemd serviceClayton Casciato9 hours1-1/+1
| | | | | | | | | Fix service startup https://docs.suricata.io/en/suricata-7.0.0/command-line-options.html#cmdoption-i Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* scap-security-guide: disable ptestYi Zhao9 hours2-58/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Enabling ptest will significantly increase build time. Additionally, since the ptest distro_feature is enabled by default in poky distro, build time can be very long, which is annoying. On my build host: Enable ptest: $ time build scap-security-guide real 219m54.529s user 0m49.040s sys 0m1.304s Disable ptest: $ time build scap-security-guide real 1m25.222s user 0m3.306s sys 0m0.166s Since no one cares about this ptest and no one fixes the test failures. Let's disable it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* scap-security-guide: upgrade 0.1.76 -> 0.1.77Scott Murray10 hours1-1/+1
| | | | | | | | | | Update to latest version to pick up fixes required for building with CMake 4.0. ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.77 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* .gitlab-ci.yml: add logging of jobs to filesHEADmasterMarta Rybczynska2025-07-041-17/+22
| | | | | | | Log kas commands to files and export them as artefacts Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* CI: update build for new CIMarta Rybczynska2025-07-041-2/+4
| | | | | | | | | | | Update for Ubuntu 24.04 runners: - use venv for installing kas - add missing directories Assume that python3 and pip are installed. Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* chkrootkit: fix building with gcc 15Scott Murray2025-07-042-2/+42
| | | | | | Add a patch to fix building chkrootkit with gcc 15. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* chkrootkit: use Debian mirrorMarta Rybczynska2025-07-041-1/+1
| | | | | | | Use the Debian mirror as the Ubuntu one is failing frequently. Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* libhoth: update to latestScott Murray2025-07-043-2/+196
| | | | | | | | | | | Update libhoth SRCREV to its latest commit, and add patches to fix gcc 15 and build dependency issues. Since the last update was so long ago, the changelog is longer than seems reasonable to include here, please refer to: https://github.com/google/libhoth/commits/main/?since=2024-01-16&until=2025-07-03 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* sshguard: Update to 2.5.1Scott Murray2025-07-041-1/+1
| | | | | | | | This picks up required gcc 15 fixes. Changelog: https://bitbucket.org/sshguard/sshguard/src/master/CHANGELOG.rst Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* scap-security-guide: fix fetchMarta Rybczynska2025-07-041-1/+1
| | | | | | | | | | | | | | | The project does not use release branches; their release model currently rebases the stable branch each release and relies on the release tags to keep the commits referenced. Until their release model changes, just use the release commit with nobranch. See upstream issue [1] for details. [1] https://github.com/ComplianceAsCode/content/issues/13543 Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> [tweaked commit message] Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* parsec-service: update PACKAGECONFIG options as lists of cargo build featuresAnton Antonov2025-07-042-11/+8
| | | | | | | | | | | After commit 7a2b9acef2 "cargo: pass PACKAGECONFIG_CONFARGS to cargo build" we don't need to include Parsec cargo build features into CARGO_BUILD_FLAGS. Let's update PACKAGECONFIG options as lists of features. A small fix in readme.md as well. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Adapt to S/UNPACKDIR changesScott Murray2025-07-0443-79/+10
| | | | | | | Remove or update S definitions as required to work with oe-core S/UNPACKDIR changes. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* layer.conf: Update to whinlatter (5.3) releaseScott Murray2025-07-045-5/+5
| | | | | | | | Update LAYERSERIES_COMPAT in all layer.conf files with the exception of meta-parsec to whinlatter. For meta-parsec, whinlatter has been added, and the EOL releases removed, as an initial update. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* smack: Use new CVE_STATUS variableClayton Casciato2025-07-041-4/+3
| | | | | | | | | Fix "CVE_CHECK_IGNORE is deprecated in favor of CVE_STATUS" https://docs.yoctoproject.org/dev/ref-manual/variables.html#term-CVE_STATUS Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Fix warning : lack of whitespace around assignmentJ. S.2025-07-0414-18/+18
| | | | | | | | | v2 : also fix some typos while we are here. v3 : add fixes for isic and checksecurity Signed-off-by: Jason Schonberg <schonm@gmail.com> [removed already applied change] Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Update maintainersScott Murray2025-06-276-55/+63
| | | | | | | | | | | Add Marta and myself as maintainers for meta-security and the other embedded layers that Armin had been maintaining. To avoid Armin getting bugged about individual recipes, set the RECIPE_MAINTAINER variables to myself for now as a starting point that can be adjusted as things get more settled. Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Remove self as MaintainerArmin Kuster2025-06-235-5/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: drop pkg_postinst_ontarget systemd initClayton Casciato2025-06-231-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | /var/log/suricata initialization is handled by systemd-tmpfiles-setup.service, which occurs before services like suricata Work towards resolving: ERROR: [...] do_rootfs: The following packages could not be configured offline and rootfs is read-only: ['100-suricata'] Added in commit 36d656fe7244 ("suricata: add tmpfiles.d config") systemd testing: root@beaglebone-yocto:~# ls -d /var/log/suricata /var/log/suricata root@beaglebone-yocto:~# systemctl enable suricata Created symlink '/etc/systemd/system/multi-user.target.wants/suricata.service' -> '/usr/lib/systemd/system/suricata.service'. root@beaglebone-yocto:~# rmdir /var/log/suricata root@beaglebone-yocto:~# reboot now root@beaglebone-yocto:~# ls -d /var/log/suricata /var/log/suricata root@beaglebone-yocto:~# journalctl -o short-iso-precise -u systemd-tmpfiles-setup -u suricata 2025-05-20T00:45:46.450027+00:00 beaglebone-yocto systemd[1]: Starting Create System Files and Directories... [...] 2025-05-20T00:45:47.041049+00:00 beaglebone-yocto systemd[1]: Finished Create System Files and Directories. 2025-05-20T00:45:47.542976+00:00 beaglebone-yocto systemd[1]: Started Suricata IDS/IDP daemon. [...] Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: resolve TMPDIR QA issues in do_configureClayton Casciato2025-06-231-5/+2
| | | | | | | | | | | | | | | | | | | | | ERROR: suricata-7.0.0-r0 do_package_qa: QA Issue: File /usr/bin/suricata in package suricata contains reference to TMPDIR [buildpaths] ERROR: suricata-7.0.0-r0 do_package_qa: QA Issue: File /usr/src/debug/suricata/7.0.0/src/build-info.h in package suricata-src contains reference to TMPDIR [buildpaths] Address references when src/build-info.h is being written This is similar to Debian's approach: https://sources.debian.org/patches/suricata/1:7.0.10-1~bpo12%2B1/reproducible.patch/ Restore the "already-stripped" check and CFLAGS info Original resolution in commit c0e3fecc3bea ("suricata: fix QA warnings") Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd: fix empty file list with sedMikko Rapeli2025-06-231-2/+5
| | | | | | | | | If measured-uki support is not enabled or build is continuing from previous stages, then the matching file list can be empty. Fixes build failure where sed says no input files. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes: fix whitespace warningsMax Krummenacher2025-06-233-4/+4
| | | | | | | | | | | | | | | Since OE bitbake commit 24772dd2ae6c ("parse/ConfHandler: Add warning for deprecated whitespace usage"), the current build generates the following warning (as example): | WARNING: ...meta-security/meta-tpm/recipes-core/systemd/systemd-boot_%.bbappend:7 | has a lack of whitespace around the assignment: | 'EXTRA_OEMESON:append= " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '-Dtpm2=true', '', d)} "' Fix all the warnings. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-yamlpath: Add python3-json to RDEPENDSChangqing Li2025-06-231-1/+2
| | | | | | | | | | | * Some sources like merger/merger.py import json, so add python3-json to RDEPENDS * Fix following warning has a lack of whitespace around the assignment: 'DESCRIPTION=xxx' Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: Add tools python runtime dependencieswalnascarOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | | | | | | The tpm2-pkcs11-tools python module is importing several modules which are not currently included in it's dependencies. This causes the script invocation to fail. The current commit adds the relevant dependencies, to ensure that the python module is always able to run. The relevant dependencies are: * python3-fcntl: To add the fcntl module, imported in db.py. * python3-sqlite3: To add the sqlite3 module, imported in db.py. * python3-tpm2-pytss: To add the tpm2_pytss module, imported in utils.py. * python3-compression: To add the zipfile module, imported through "importlib.metadata import distribution" in tpm2_ptool. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pytss: Add python3-asn1crypto runtime dependencyOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | The tpm2-pytss module is importing the module asn1crypto in tsskey.py, however, the current bitbake recipe is not including this python package as runtime dependency. This causes the module invocation to fail at the moment. The commit adds this dependency to the bitbake recipe, to make the recipe self contained. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pcr-extend: fix config errorArmin Kuster2025-04-131-0/+2
| | | | | | | | | Skip configure step to fix this error: pcr-extend-0.1+git-r0 do_configure: no configure script found at ../git/configure There is no configure for this package. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: fix build error introduced by upstream commitArmin Kuster2025-04-131-0/+12
| | | | | | | | | | 7a2b9acef2 cargo: pass PACKAGECONFIG_CONFARGS to cargo build error: unexpected argument '--with-libcap_ng-includes' found | | Usage: cargo build --verbose... --target [<TRIPLE>] --release --manifest-path <PATH> --offline Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: enable unprivileged service user featureYi Zhao2025-04-131-4/+10
| | | | | | | | | | | The unprivileged service user feature has been improved in 2.10 to allow running the sssd service as an unprivileged user [1]. So enable this feature, and then we can run the service as the unprivileged user sssd. [1] https://github.com/SSSD/sssd/releases/tag/2.10.0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: upgrade 2.9.2 -> 2.10.2Yi Zhao2025-04-135-559/+18
| | | | | | | | | | | | ChangeLog: https://github.com/SSSD/sssd/releases/tag/2.10.2 * Drop backport patches. * Update sssd.conf and volatile files. * Drop PACKAGECONFIG[infopipe] as it has been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgssglue: add ptestYi Zhao2025-04-132-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ptest result: ptest-runner libgssglue START: ptest-runner 2025-03-27T13:15 BEGIN: /usr/lib64/libgssglue/ptest PASS: gss_create_empty_oid_set PASS: gss_test_oid_set_member PASS: gss_test_oid_set_member n==0 PASS: gss_add_oid_set_member() OK PASS: gss_test_oid_set_member() OK OID present in set with the OID added to it => 1 PASS: gss_test_oid_set_member() OK PASS: gss_test_oid_set_member() OK Another OID present in set without the OID => 0 PASS: gss_test_oid_set_member() OK PASS: gss_add_oid_set_member() OK PASS: gss_test_oid_set_member() OK Another OID present in set with it added => 1 PASS: gss_test_oid_set_member() OK PASS: gss_test_oid_set_member() OK First OID present in set => 1 PASS: gss_test_oid_set_member() OK PASS: gss_release_oid_set() OK PASS: gss_indicate_mechs() OK PASS: gss_release_oid_set() OK PASS: gss_import_name() OK PASS: gss_display_name() OK display_name() => 27: imap@server.example.org@FOO PASS: gss_release_buffer() OK PASS: gss_release_name() OK Basic self tests done with 0 errors DURATION: 0 END: /usr/lib64/libgssglue/ptest 2025-03-27T13:15 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgssglue: upgrade 0.8 -> 0.9Yi Zhao2025-04-132-64/+2
| | | | | | | * Drop useless patch libgssglue-canon-name.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: upgrade 4.4.10 -> 4.5.2Yi Zhao2025-04-1315-118/+168
| | | | | | | | | | ChangeLog: https://fossies.org/linux/samhain/docs/Changelog * Refresh patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-yamlpath: upgrade 3.8.0 -> 3.8.2Changqing Li2025-04-131-1/+6
| | | | | | | | | | | | | | | | | | | | | | | Release note: Enhancements: The MergerConfig class now accepts overrides for config values as "keys" and "rules" keyword arguments to the constructor. Credit and my thanks go to https://github.com/leviem1! BREAKING CHANGES: Support for Python 3.6 has been dropped. This is forced by incompatibilities discovered with the latest version of pytest and because dependencies like dateutil and ruamel-yaml-clib no longer support Python 3.6. Support for Python 3.7 is tepid. While pytest is still working with Python 3.7, other dependencies are no longer supporting Python 3.7; however, the extensive tests for yamlpath show no issues with them, so far. For now, Python 3.12 support is pending, waiting for the dateutil library to resolve a DeprecationWarning regarding its use of datetime.datetime.utcfromtimestamp(). Refer: https://pypi.org/project/yamlpath/3.8.2/ Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-xmldiff: upgrade 2.6.3 -> 2.7.0Changqing Li2025-04-131-1/+8
| | | | | | | | | | | | | | | | | | Changes: 2.7.0 (2024-05-13) * Changed the comparison to make accurate and standard more accurate, although fast gets less accurate as a result. * Changed usage of deprecated pkg_resources package to importlib.metadata. * A use_replace flag was added to the XMLFormatter by Thomas Pfitzinger. It changes text replacement from delete and insert tags to a replace tag. It’s not currently accessaible thtough the CLI, the question is it is better to add a new formatter name, or an option to pass in formatter flags. - Added option to XMLFormatter to use replace tags - in _make_diff_tags after diffing, neighboring delete/insert diffs are joined to a replace tag - the deleted text is added as an attribute (“old-text”) - the inserted text is the element’s text Refer: https://pypi.org/project/xmldiff/2.7.0/ Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhtp: update to 0.5.50Armin Kuster2025-04-132-152/+2
| | | | | | drop CVE-2024-45797.patch now included Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update to walnascar (5.2) layer/release seriesArmin Kuster2025-04-131-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: upgrade 0.1.75 -> 0.1.76Yi Zhao2025-04-131-1/+1
| | | | | | | | ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss-engine: add .so symmlink to engines packageAdrian Freihofer2025-04-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Without the symlink, the engine is not found by openssl: openssl engine -t -c tpm2tss 20F0C5BDFFFF0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:/usr/src/debug/openssl/3.2.4/crypto/dso/dso_dlfcn.c:118: filename(/usr/lib/engines-3/tpm2tss.so): /usr/lib/engines-3/tpm2tss.so: cannot open shared object file: No such file or directory ... With sym-link it works (also without extra configuration for openssl) cd /usr/lib/engines-3/ ln -s libtpm2tss.so tpm2tss.so openssl engine -t -c tpm2tss (tpm2tss) TPM2-TSS engine for OpenSSL [RSA, RAND] [ available ] For exmample also the Fedora package has the symlink. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-openssl: update to 1.3.0Michael Haener2025-04-131-2/+2
| | | | | Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: upgrade 0.1.74 -> 0.1.75Yi Zhao2025-03-121-1/+1
| | | | | | | | ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: upgrade 1.4.0 -> 1.4.1Yi Zhao2025-03-121-1/+1
| | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/OpenSCAP/openscap/releases/tag/1.4.1 * Introduce "oscap-im" - script that can be used in Containerfiles to build hardened bootable container images to run as Image Mode Operating System * Add support for containers with no entrypoint/cmd in "oscap-docker" * Stop printing useless component reference information in "oscap info" * Fix missing declaration of PATH_MAX on Solaris * Fix RPM database path in RPM probes (RHEL-55251, #2151) * Fix issues reported by OpenScanHub after 1.4.0 release * Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x architecture * Ensure xlink namespace exists (RHEL-34104) * Minor fixes in test suite and CI Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: set sparse as "never" during initial file copyLorenzo Arena2025-03-121-1/+1
| | | | | | | | | This is needed when a verity image is used in conjunction with tools like a WIC and a bmap file, as avoiding writing "sparse" sectors can result in errors in the signature verification. Signed-off-by: Lorenzo Arena <arena.lor@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Enable choice of creating IMA signatures or hashesStefan Berger2025-03-122-2/+9
| | | | | | | | | | | | | | | | | | | When IMA and EVM are used for file appraisal then EVM verifies the signature stored in security.evm. This signature covers file metadata (uid, gid, mode bits, etc.) as well as the security.ima xattr. Therefore, it is sufficient that only files' hashes are stored in security.ima. This also leads to slight performance improvements since IMA appraisal will then only verify that a file's hash matches the expected hash stored in security.ima. EVM will ensure that the signature over all the file metadata and security.ima xattr is correct. Therefore, give the user control over whether to store file signatures (--imasig) in ima.security or hashes (--imahash) by setting the option in IMA_EVM_IMA_XATTR_OPT. Only test-verify an IMA signature if --imasig is used as the option. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: update to 3.1.4Armin Kuster2025-02-021-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security: Remove True option to getVar callsakash hadke2025-02-022-3/+3
| | | | | | | | getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: musl don't build apparmorArmin Kuster2025-01-062-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: drop firejail for muslArmin Kuster2025-01-061-1/+1
| | | | | | | appears to be a known issue: https://bugs.gentoo.org/937374 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* .gitlab-ci: speed up parsec buildsArmin Kuster2025-01-061-4/+4
| | | | | | build parsec image not the larger generic security image Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: add pipeline badgeArmin Kuster2025-01-061-0/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-service: fix build errorArmin Kuster2025-01-062-0/+52
| | | | | | | | | | | Fixes: | error: unnecessary qualification | --> src/front/domain_socket.rs:247:30 | | | 247 | let ucred_size = mem::size_of::<ucred>(); | | ^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-18 22:53:32 +0000