summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* fail2Ban: Add new packageArmin Kuster2017-09-013-0/+314
| | | | | | | | Fail2Ban scans log files like /var/log/auth.log and bans IP addresses having too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time. Fail2Ban comes out-of-the-box ready to read many standard log files, such as those for sshd and Apache, and is easy to configure to read any log file you choose, for any error you choose. Though Fail2Ban is able to reduce the rate of incorrect authentications attempts, it cannot eliminate the risk that weak authentication presents. Configure services to use only two factor or public/private authentication mechanisms if you really want to protect services. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sleuthkit: fix No GNU_HASH in the elf binaryArmin Kuster2017-08-311-0/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: drop all 4.1 contentMikko Ylinen2017-08-317-20627/+0
| | | | | | | | | | | | linux-yocto_4.1.bb recipe has been removed from oe-core master and that triggers a bitbake error due to orphan bbappends maintained in meta-security. To fix the error, drop linux-yocto_4.1.bbappend plus the patches and the config fragments for it. Signed-off-by: Mikko Ylinen <mikko.ylinen@linux.intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: add 4.12 bbappendsArmin Kuster2017-08-314-0/+33
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tripwire: update to 2.4.3.5Armin Kuster2017-08-311-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: update to 4.2.2Jackie Huang2017-08-3117-83/+763
| | | | | | | | | | | | | * update to version 4.2.2 * Add new recipe for standalone mode * Add systemd support * Add patches to fix several issues * samhain-standalone: add ptest support * samhain-server: no need to depend on samhain-server-native * Move common things from the bb to the inc file Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: Additional runtime fixesTom Rini2017-08-132-8/+28
| | | | | | | | | | | | | | | | | | | - We need various python3 modules and we can only really solve this problem by including all python3-modules. - aa-easyprof needs to have its shebang corrected, do so. - The apparmor initscript depends on functions that LSB does not require so we must provide them. In some cases it's using non-standard function, so we just use more appropriate names. - The apparmor sysvinit-style initscript assumes that systemd-detect-virt will exist on the filesystem. Change this to check that it does before trying to execute it. [for aa-easyprof:] Reported-by: Anders Montonen <Anders.Montonen@iki.fi> Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libmhash: add new recipeJackie Huang2017-08-134-0/+94
| | | | | | | | | | Mhash is a free (under GNU Lesser GPL) library which provides a uniform interface to a large number of hash algorithms. These algorithms can be used to compute checksums, message digests, and other signatures. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgssglue: add new recipeJackie Huang2017-08-136-0/+223
| | | | | | | | libgssglue exports a gssapi interface which calls other gssapi libraries. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nmap: upgrade to 7.50Jackie Huang2017-08-133-11/+97
| | | | | | | | | | | | | | | | | | | - Add a patch to fix python library install dir for multilib. - Add a patch to fix race condition with mkdir command. - Inherit pythonnative instead of python-dir and install python modules for ndiff to fix the following errors: """ root@qemux86-64:~# ndiff --help -sh: /usr/bin/ndiff: /path_to_build/tmp/hosttools/python: bad interpreter: No such file or directory root@qemux86-64:~# python /usr/bin/ndiff Could not import the ndiff module: 'No module named ndiff'. """ Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* keynote: add new recipeJackie Huang2017-08-134-0/+126
| | | | | | | | | KeyNote is a simple and flexible trust-management system designed to work well for a variety of large- and small- scale Internet-based applications Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tools: update to 2.0.0 plusArmin Kuster2017-08-131-6/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlsec1: add new recipeJackie Huang2017-07-316-0/+296
| | | | | | | XML Security Library is a C library based on LibXML2 and OpenSSL. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: Rework such that the utilities are functional by defaultTom Rini2017-07-313-7/+54
| | | | | | | | | | | | | | | | | | | | | | This introduces a number of changes: - Fix the python PACKAGECONFIG knob - The included python support is python3-based, so use those classes. - When set, make sure to RDEPEND on the python modules the tools use. - Fix the perl PACKAGECONFIG knob - Add two patches so that configure will find perl and then compile will cross-compile the library correctly. - So that we place perl modules in the correct location we need cpan to be inherited. - When disabled, remove the RDEPENDS on perl as the RDEPENDS comes in via inherit. - Default to enabling the python and perl PACKAGECONFIG knobs as the majority of the userspace tools are python3 based, and the few that aren't that nor C based are perl based. - Because of the above we must drop the -python package because it's required for the utilities in the main package. Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix python packaging issueArmin Kuster2017-06-011-2/+2
| | | | | | | | | | | | | | WARNING: apparmor-2.11.0-r0 do_package: QA Issue: apparmor: Files/directories were installed but not shipped in any package: /usr/lib/python2.7 /usr/lib/python2.7/site-packages /usr/lib/python2.7/site-packages/apparmor-2.11.0-py2.7.egg-info /usr/lib/python2.7/site-packages/apparmor /usr/lib/python2.7/site-packages/apparmor/regex.py use python2 instead of python3 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: add new recipeJackie Huang2017-06-013-0/+137
| | | | | | | | | | eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* keyutils: add new recipeJackie Huang2017-06-015-0/+159
| | | | | | | | | | | | keyutils is utilities to control the kernel key management facility and to provide a mechanism by which the kernel call back to userspace to get a key instantiated. It's required by ecryptfs-utils. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: fix typo (meta-filesystems vs mete-filesystems)André Draszik2017-06-011-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm-i2c: fix syntaxPeter Lei2017-05-191-1/+1
| | | | | | | Fix "ERROR: ExpansionError during parsing" when building with multilib. Signed-off-by: Peter Lei <peter.lei@ieee.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tor: add recipeArmin Kuster2017-05-151-0/+7
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer-conf: Use *_FEATURES in LAYERDEPENDSArmin Kuster2017-05-141-1/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* security-core package group: add few more appsArmin Kuster2017-05-141-1/+6
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: fix new build errorArmin Kuster2017-05-141-1/+1
| | | | | | | | configure: error: The installed zlib version may contain a security bug. Please upgrade to 1.2.2 or later: http://www.zlib.net. You can omit this check with --disable-zlib-vcheck but DO NOT REPORT any stability issues then! bypass check as our zlib is 1.2.11 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: update SRC_URI as git.fedorahosted.org shut downArmin Kuster2017-05-141-11/+9
| | | | | | build fixes too Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2: package groups fixesArmin Kuster2017-05-143-1/+18
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-stable: fix module selectionsArmin Kuster2017-05-144-0/+18
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm-image: used for testing for now.Armin Kuster2017-05-141-0/+19
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kernel tpm reworkArmin Kuster2017-05-149-5/+53
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm-i2c: some systems us i2c TPMArmin Kuster2017-05-141-0/+17
| | | | | | add modules and i2c support Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm packagegroups: split into logical unitsArmin Kuster2017-05-143-9/+32
| | | | | | | this should help mitgate the need to pull in too many layers if swtpm in not wanted Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup: remove tpm componentsArmin Kuster2017-05-141-14/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-tpm: add base package group as was in meta-securityArmin Kuster2017-05-141-0/+23
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* change tpm from distro to machine featureArmin Kuster2017-05-142-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm: move to a sub layerArmin Kuster2017-05-1426-3/+18
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm-wrappers-native.bb: need netstatPatrick Ohly2017-05-071-1/+1
| | | | | | | | | netstat from net-tools-native is needed for swtpm_setup.sh, which uses it to check whether the swtpm daemon has started. The scripts hangs in a loop during startup when netstat is missing. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freediameter: Add recipeArmin Kuster2017-05-074-0/+493
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm-wrappers: fix naming convention violationPatrick Ohly2017-04-251-0/+0
| | | | | | | | | | | | | Native recipes must be called <foo>-native. This is more than just a recommendation, there's actual code which checks for the suffix. Not following that rule broke swtpm-wrappers when using the "usrmerge" DISTRO_FEATURE, because the code in native.bbclass which cleans up DISTRO_FEATURES for native recipes was skipped and thus swtpm-wrappers ended up using different paths than the other native recipes. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tss: update to tip.Armin Kuster2017-04-252-29/+1
| | | | | | remove merged patch now in tip Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: update to 4.2.1Armin Kuster2017-04-254-21/+2
| | | | | | remove patch integrated into update Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update to latest tipAmarnath Valluri2017-04-131-1/+1
| | | | | | | | | Pull in changes to support passing client control sockets(--ctrl type=unixio,clientfd=<fd>), that allows to fork swtpm and communicate using socketpair. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: update to 2.11.0 plus ptestArmin Kuster2017-04-063-116/+130
| | | | | | | | | update to 2.11 Add basic ptest support v2: remove none existent file Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: add 4.10 kernel supportArmin Kuster2017-04-064-0/+36
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libseccomp: update to 2.3.2Armin Kuster2017-04-061-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tss: fix musl build issueArmin Kuster2017-04-062-1/+31
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kernel: mv 4.8 kernel to 4.9Armin Kuster2017-04-066-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tss: update to latestArmin Kuster2017-04-061-6/+13
| | | | | | | | | | | | [v2]: include new hash LICENSE file changes do to removal of TCG minor changes do to configure and makefile updates Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tools: update to latestArmin Kuster2017-04-061-8/+5
| | | | | | | minor changes to reflect configure/makefile updates Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: fix build issues when using muslArmin Kuster2017-03-272-0/+23
| | | | | | | | | | | | | | | | | | | | [v2]: Correct musl malloc fix. remove HAVE_MALLOC_H define; this enables using the included defined mallinfo. [V1]: Fix c99 x_dnmalloc.c:563:26: error: return type is an incomplete type | #define public_mALLINFo mallinfo | ^ | x_dnmalloc.c:1689:17: note: in expansion of macro 'public_mALLINFo' | struct mallinfo public_mALLINFo() { and _dnmalloc.c:5527:17: error: unknown type name 'u_int' | u_int rnd[(128 - 2*sizeof(struct timeval)) / sizeof(u_int)]; | ^~~~~ Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2.0-tss: install resourcemgr serviceBenjamin Gaignard2017-03-271-2/+22
| | | | | | | | | | Install systemd resource.mgr service and it needed user/group. version 2: - do not hardcode sbin directory in a patch but use ${sbindir} instead Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org> Signed-off-by: Armin Kuster <akuster@mvista.com>
* swtpm-wrappers: wrap more commandsPatrick Ohly2017-03-271-7/+19
| | | | | | | | | Soon it might be possible to let qemu start swtpm directly, without requiring root privileges as for swtpm_cuse. For that to work we also need to wrap the swtpm binary. Just in case we now also do it for everything. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 04:30:05 +0000