summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* dm-verity-img.bbclass: Stage verity.env fileniko.mauno@vaisala.com2020-09-122-4/+8
| | | | | | | | | | | | | | | | | | | | Introduce new STAGING_VERITY_DIR variable specific to this bbclass which defines the directory where the verity.env file is stored during <DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE> task and can consequtively be picked up into associated initramfs rootfs (which facilitates executing 'veritysetup' and related actions). By doing this we mitigate failures that were thus far associated to this facility, such as install: cannot stat '.../build/tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.ext4.verity.env': No such file or directory and install: cannot stat '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity.env': No such file or directory Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto(-dev): Add dm-verity fragment as neededniko.mauno@vaisala.com2020-09-122-0/+2
| | | | | | | | Add checks that include dm-verity specific kernel config fragment when dm-verity-img.bbclass is used. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: Bind at do_image insteadniko.mauno@vaisala.com2020-09-121-3/+3
| | | | | | | | | Bind custom actions in this image recipe in do_image() rather than do_rootfs(), which can help shaving even dozens of seconds from duration of 'bitbake <DM_VERITY_IMAGE>' command re-execution. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: Ensure verity hash syncniko.mauno@vaisala.com2020-09-121-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to ensure that the bundled initramfs always contains the most recently generated DM_VERITY_IMAGE specific root filesystems' root hash, we disable the timestamp for do_rootfs() task here, meaning that the task will be re-executed whenever some task that depends on it executes. Without this change, executing e.g. the following sequence $ bitbake <DM_VERITY_IMAGE> $ bitbake -c clean <DM_VERITY_IMAGE> $ bitbake <DM_VERITY_IMAGE> results in an unbootable <DM_VERITY_IMAGE> rootfs, which fails like Mounting /dev/vda over dm-verity as the root filesystem [ 8.729974] device-mapper: verity: sha256 using implementation sha256-generic [ 8.810784] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.813018] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.813912] Buffer I/O error on dev dm-0, logical block 2992, async page read Verity device detected corruption after activation. [ 8.889548] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.891060] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.891456] Buffer I/O error on dev dm-0, logical block 2992, async page read ... [ 9.135707] EXT4-fs (dm-0): unable to read superblock [ 9.142897] EXT4-fs (dm-0): unable to read superblock [ 9.145393] EXT4-fs (dm-0): unable to read superblock [ 9.147905] FAT-fs (dm-0): unable to read boot sector mount: /new_root: can't read superblock on /dev/mapper/rootfs. BusyBox v1.32.0 () multi-call binary. Usage: switch_root [-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS] [ 9.243274] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 [ 9.243701] CPU: 0 PID: 1 Comm: switch_root Not tainted 5.8.3-yocto-standard #1 [ 9.243853] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 ... [ 9.248548] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]--- Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: Reorder parse-time checkniko.mauno@vaisala.com2020-09-121-3/+3
| | | | | | | | | | | | | | | | | | | | Relocate checking if DM_VERITY_IMAGE and DM_VERITY_IMAGE_TYPE are defined as non-empty strings before DM_VERITY_IMAGE vs. PN comparison is performed. By doing so we start seeing following kind of bitbake parse-time console warnings in case either DM_VERITY_IMAGE or DM_VERITY_IMAGE_TYPE is not set, when 'dm-verity-img' is defined in IMAGE_CLASSES: WARNING: .../meta/recipes-core/images/core-image-minimal.bb: dm-verity-img class inherited but not used WARNING: .../meta-openembedded/meta-oe/recipes-core/images/meta-oe-ptest-image.bb: dm-verity-img class inherited but not used whereas before this change this warning was printed only once, when image pointed by <DM_VERITY_IMAGE> was parsed (and recipe with that name could be found in BBFILES mask scipe), and DM_VERITY_IMAGE_TYPE was not set. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: Fix bashismsniko.mauno@vaisala.com2020-09-121-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resort to printf in order to avoid usage of non-POSIX compliant echo flags. This mitigates following errors visible in console during boot-up with image that has been built on a host that symlinks '/bin/sh' to 'dash': /init: /usr/share/dm-verity.env: line 1: -NE_UUID: not found /init: /usr/share/dm-verity.env: line 2: -ne: not found /init: /usr/share/dm-verity.env: line 3: 642864e8-6a17-46b9-ba1e-9386a3909c8d: not found /init: /usr/share/dm-verity.env: line 4: -NE_HASH_TYPE: not found /init: /usr/share/dm-verity.env: line 5: -ne: not found /init: /usr/share/dm-verity.env: line 6: 1: not found /init: /usr/share/dm-verity.env: line 7: -NE_DATA_BLOCKS: not found /init: /usr/share/dm-verity.env: line 8: -ne: not found /init: /usr/share/dm-verity.env: line 9: 12064: not found /init: /usr/share/dm-verity.env: line 10: -NE_DATA_BLOCK_SIZE: not found /init: /usr/share/dm-verity.env: line 11: -ne: not found /init: /usr/share/dm-verity.env: line 12: 1024: not found /init: /usr/share/dm-verity.env: line 13: -NE_HASH_BLOCK_SIZE: not found /init: /usr/share/dm-verity.env: line 14: -ne: not found /init: /usr/share/dm-verity.env: line 15: 4096: not found /init: /usr/share/dm-verity.env: line 16: -NE_HASH_ALGORITHM: not found /init: /usr/share/dm-verity.env: line 17: -ne: not found /init: /usr/share/dm-verity.env: line 18: sha256: not found /init: /usr/share/dm-verity.env: line 19: -NE_SALT: not found /init: /usr/share/dm-verity.env: line 20: -ne: not found /init: /usr/share/dm-verity.env: line 21: 19d98185b42a897a37db6c56c7470ab2d455f0de46daa0df735eee6263816439: not found /init: /usr/share/dm-verity.env: line 22: -NE_ROOT_HASH: not found /init: /usr/share/dm-verity.env: line 23: -ne: not found /init: /usr/share/dm-verity.env: line 24: 298d75fc2ea27fe594b6a37158a6ae7538e77d918bab98c475934f625de0e4ab: not found Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: update patch to fix do_patch errorQi.Chen@windriver.com2020-09-121-77/+78
| | | | | | | Currently sssd's do_patch task fails. Update the patch to fix this problem. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: Fix the problem that do_package fails when multilib is enabled.Zheng Ruoqin2020-09-121-0/+2
| | | | | | | | | | | | The following error will occur when multilib is enabled: ERROR: trousers-0.3.14+gitAUTOINC+e74dd1d967-r0 do_package: QA Issue: trousers: Files/directories were installed but not shipped in any package: /lib /lib/systemd /lib/systemd/system /lib/systemd/system/tcsd.service Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryptsetup-tpm-incubator: remove reference from other filesArmin Kuster2020-09-052-3/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Avoid nss function conflicts with glibc nss.hArmin Kuster2020-09-052-0/+78
| | | | | | | | | | glibc 2.32 will define these varibles [1] which results in conflicts with these static function names, backport a fix from upstream [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=499a92df8b9fc64a054cf3b7f728f8967fc1da7d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryptsetup-tpm-incubator: drop recipeArmin Kuster2020-09-052-63/+0
| | | | | | The upstream package appears to tbe dead so drop it. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* .gitlab: send error reportsArmin Kuster2020-08-291-5/+9
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas/kas-security-base.yml: lets enable error reportingArmin Kuster2020-08-291-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* upload-error-report: add script to upload errorsArmin Kuster2020-08-291-0/+26
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: Make manpages buildableJonatan Pålsson2020-08-292-1/+37
| | | | | | | Some XML related fixes are needed to make the sssd manpages buildable Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: update to tipArmin Kuster2020-08-292-96/+1
| | | | | | | | | Many for compile issue now being seen. rpc/tcstp/.libs/libtspi_la-rpc_cmk.o:/usr/src/debug/trousers/0.3.14+gitAUTOINC+4b9a70d578-r0/build/src/tspi/../../../git/src/include/tcsd.h:169: multiple definition of `tcsd_sa_int'; .libs/libtspi_la-tspi_context.o:/usr/src/debug/trousers/0.3.14+gitAUTOINC+4b9a70d578-r0/build/src/tspi/../../../git/src/include/tcsd.h:169: first defined here | collect2: error: ld returned 1 exit status Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: Several Security fixesArmin Kuster2020-08-172-0/+95
| | | | | | | | | | Fixes: CVE-2020-24332 CVE-2020-24330 CVE-2020-24331 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libseccomp: fix cross compile error for mipsKai Kang2020-08-042-0/+50
| | | | | | | | | | | Backport patch to fix cross compile error for mips: | syscalls.h:44:6: error: expected identifier or '(' before numeric constant | 44 | int mips; | | ^~~~ Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: add INSTALL_CLAMAV_CVD flag to do_installCharlie Davies2020-08-041-1/+3
| | | | | | | | | Recipe provides INSTALL_CLAMAV_CVD flag to bypass clamav cvd db creation. During do_install this flag should be used to conditionally skip install of cvd db if needed. Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: restore riscv64 for libssecompArmin Kuster2020-07-271-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libseccomp: update to 2.5.0Armin Kuster2020-07-271-4/+5
| | | | | | | | | | | Notable changes: Add support for the 64-bit RISC-V architecture Update the syscall tables to Linux v5.8.0-rc5 Python bindings and build now default to Python 3.x for more info see: https://github.com/seccomp/libseccomp/blob/master/CHANGELOG Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: remove libseccomp for riscv*Armin Kuster2020-07-271-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libsecomp: rv32/rv64 target builds are not supported yetArmin Kuster2020-07-271-0/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: remove clamav for riscv*Armin Kuster2020-07-251-3/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm: add more packages for buildingArmin Kuster2020-07-251-0/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* security packagegroups: move to recipes-coreArmin Kuster2020-07-252-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* security images: Move to recipe-coreArmin Kuster2020-07-254-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: upgrade 1563 -> 1628Yi Zhao2020-07-252-27/+26
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: update to 3.0.0Armin Kuster2020-07-251-2/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* drop ci-build: it is hiding errorsArmin Kuster2020-07-244-27/+22
| | | | | | | | | call kas from .gitlab-ci fix typos add missing mips64 file add main layer workaround Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: add ima, tpm and tpm2 build configsArmin Kuster2020-07-199-1/+97
| | | | | | for qemux86, qemux86-64 and qemuarm64 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* add gitlab framework and qemu machineArmin Kuster2020-07-1810-0/+161
| | | | | | | | | | | | | Machines: qemux86 qemux86-64 qemuarm qemuarm64 qemuppc qemumips84 qemuriscv64 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: add dynamic-layer for strongswanArmin Kuster2020-07-181-0/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: Add bbappends for ima changesArmin Kuster2020-07-182-0/+62
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: add dynamic-layer for strongswanArmin Kuster2020-07-181-0/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: add bbappends for tpm changesArmin Kuster2020-07-183-0/+51
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-privacyidea: adding initial support for mfaArmin Kuster2020-07-181-0/+40
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-oauth2client: add recipeArmin Kuster2020-07-181-0/+11
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm2: Depend on preferred provider for cryptsetupJeremy Puhlman2020-07-141-1/+2
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-devJeremy Puhlman2020-07-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | Without this we get weird conflict when you include dev packages: rror: Transaction check error: file /usr/include/libcryptsetup.h conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib64/libcryptsetup.so conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib64/pkgconfig/libcryptsetup.pc conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib/libcryptsetup.so conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib/pkgconfig/libcryptsetup.pc conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* bastille: Deleted redundant inherit to fix error when enable multilib.Zheng Ruoqin2020-07-141-2/+0
| | | | | | | | There is no need to inherit module-base. Because this inherit will stop bastille to build to lib32-bastille. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ccs-tools:Fix build error when enable multilib.Zheng Ruoqin2020-07-141-1/+1
| | | | | | | | | | | | ERROR: lib32-ccs-tools-1.8.4-r0 do_install: oe_runmake failed ERROR: lib32-ccs-tools-1.8.4-r0 do_install: Execution of '/build-armv8/tmp/work/armv7ahf-neon-mllib32-linux-gnueabi/lib32-ccs-tools/1.8.4-r0/temp/run.do_install.22368' failed with exit code 1: make: *** No rule to make target 'install'. Stop. WARNING: exit code 1 from a shell command. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* isafw.bbclass: typo in layer nameArmin Kuster2020-07-061-0/+0
| | | | | | move class to proper layer Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security-ptest: update fail2ban ptest pkg nameArmin Kuster2020-07-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 4.1.8Armin Kuster2020-07-063-3/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: disable build secretsKai Kang2020-06-231-4/+3
| | | | | | | | | | | | | | | | | | | It requires http_parser.h to build secrets: | configure: error: | You must have the header file http_parser.h installed to build sssd | with secrets responder. If you want to build sssd without secret responder | then specify --without-secrets when running configure. The header file is from package http-parser[1] rather than apache2. But there is no recipe http-parser in openembedded. So disable build secrets for sssd and remove related systemd service and socket files. Reference: 1. https://github.com/nodejs/http-parser Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: pull in coreutils/findutils only when not using systemd as init ↵Alexander Kanavin2020-06-191-1/+2
| | | | | | | | | | | | manager The utilities from those packages (xargs, comm) are only used in sysvinit scripts, and so there is no need to pull them in when systemd is in use. Both are gpl3 licensed, so this is beneficial for builds where gpl3 is not allowed. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tripwire: Remove makefiles from the man directories.Jeremy Puhlman2020-06-191-0/+1
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: resolve multilib issuesJeremy Puhlman2020-06-191-1/+4
| | | | | Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tcti-uefi: drop patch no longer neededArmin Kuster2020-06-192-25/+2
| | | | | | | drop tpm2-get-caps-fixed.patch, tss update negated the need for this change. Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 14:47:13 +0000