summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* sssd: update to latest ltm 1.16.5Armin Kuster2020-10-102-3/+37
| | | | | | fix musl support Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libest: fix musl build.Armin Kuster2020-10-101-0/+4
| | | | | | | | | fixes est.c:38:10: fatal error: execinfo.h: No such file or directory | 38 | #include <execinfo.h> | | ^~~~~~~~~~~~ Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: fix musl buildArmin Kuster2020-10-102-0/+16
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix build for on muslArmin Kuster2020-10-106-1/+185
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* qemux86-test: add apparmor backArmin Kuster2020-10-101-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: fix compiling on gcc10Armin Kuster2020-10-091-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: apparmor 3.0 ptest does not buildArmin Kuster2020-10-091-1/+0
| | | | | | for now skip apparmor ptest Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: update to 3.0Armin Kuster2020-10-095-136/+158
| | | | | | | | | skip ptest for now, on todo list for fix. Runtime test pass remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
* security-test-image: tweak to get more tests to runnArmin Kuster2020-10-091-1/+8
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix build issue with ptest enabled.Armin Kuster2020-10-092-91/+186
| | | | | | minor spacing cleanup Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-%/5.x: Add dm-verity fragment as neededNaveen Saini2020-10-091-1/+1
| | | | | | | | Add checks that include dm-verity specific kernel config fragment when dm-verity-img.bbclass is used. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wic: add wks.in for intel dm-verityNaveen Saini2020-10-091-0/+15
| | | | | | | | | Based on systemd-bootdisk-microcode.wks.in, this adds the dm-verity image similar to the beaglebone wks already in meta-security. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework/dmverity: add retry loop for slow boot devicesNaveen Saini2020-10-091-27/+37
| | | | | | | | | | | Detection of USB devices by the kernel is slow enough. We need to keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>) and sleep between each attempt (default: one second, rootdelay=<seconds>). Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4 Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security-ptest: removeArmin Kuster2020-10-011-27/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* security-test-image: simplifyArmin Kuster2020-10-012-24/+16
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security-ptest: remove keyutils-ptestArmin Kuster2020-10-011-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libseccomp: fix ptest failures.Armin Kuster2020-10-011-1/+1
| | | | | | | | | | Fixes: BusyBox v1.32.0 () multi-call binary. Usage: dd [if=FILE] [of=FILE] [bs=N] [count=N] [skip=N] Don't use Busybox dd, not compatable. Use coreutils Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: allow test to failArmin Kuster2020-10-011-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: add opendnssec to pkg grpArmin Kuster2020-09-291-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opendnssec: add recipeArmin Kuster2020-09-294-0/+391
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitignore addedAdrian2020-09-291-0/+7
| | | | | | | | After running testimage there are some python left overs at lib/oeqa/runtime/cases/__pycache__/ Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: add libest packageArmin Kuster2020-09-291-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libest: add recipeArmin Kuster2020-09-291-0/+23
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: add softHSMArmin Kuster2020-09-291-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* softHSM: add pkgArmin Kuster2020-09-291-0/+30
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: build with ptest. remove apparmorArmin Kuster2020-09-292-3/+2
| | | | | | apparmor does not build with ptest enabled. skipping it for now Signed-off-by: Armin Kuster <akuster808@gmail.com>
* qemu test: set ptestArmin Kuster2020-09-181-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base: set RPM and disable ptestArmin Kuster2020-09-181-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: add alt and mutli build imagesArmin Kuster2020-09-187-0/+100
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: exclude mips64, not supportedArmin Kuster2020-09-181-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: add more pkgs to base groupArmin Kuster2020-09-181-4/+13
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base: define sections as baseArmin Kuster2020-09-181-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmtpm2tss: add recipeJens Rehsack2020-09-132-0/+152
| | | | | | | | Add recipe for companion of IBM Software TPM 2.0 - IBM's TPM 2.0 TSS. It's a user space TSS for TPM 2.0. Signed-off-by: Jens Rehsack <sno@netbsd.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: update SO_VER to 9.0.4Charlie Davies2020-09-131-1/+1
| | | | | Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-harden: Add a layer to demo harding OE/YPArmin Kuster2020-09-1311-0/+237
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: add testimageArmin Kuster2020-09-121-0/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: add dm-verify-imageArmin Kuster2020-09-121-0/+7
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: add one dm-verify image buildArmin Kuster2020-09-122-0/+19
| | | | | | gitlab-ci: add qemux86-64-dm-verify build image Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: add test configArmin Kuster2020-09-121-0/+11
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base: add testimageArmin Kuster2020-09-121-0/+4
| | | | | | allow root to login Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: update to 1637Jens Rehsack2020-09-125-52/+116
| | | | | | | | | | Update ibmswtpm2 from 1628 to 1637. Build 1637 Includes: * Increase NV memory size to match PC Client RSA 3072 requirements * Add and fix ACT support * Update Visual Studio files to 2019. Signed-off-by: Jens Rehsack <sno@netbsd.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: dont include suricata on riscv or ppcArmin Kuster2020-09-121-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* beaglebone-yocto-verity.wks.in: Refer IMGDEPLOYDIRniko.mauno@vaisala.com2020-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | Since dm-verity-image.bbclass effectively injects <DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE> dependency for do_image_wic task, we can change verity rootfs artifact reference here from DEPLOY_DIR_IMAGE to IMGDEPLOYDIR in order to mitigate following breakage which was observed when bitbaking <DM_VERITY_IMAGE> target from scratch (using sstate-cache provided artifacts): | wic.filemap.Error: cannot open image file '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity': [Errno 2] No such file or directory: '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity' | WARNING: exit code 1 from a shell command. | ERROR: Task (.../meta/recipes-core/images/core-image-minimal.bb:do_image_wic) failed with exit code '1' Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: Drop locales from imageniko.mauno@vaisala.com2020-09-121-0/+1
| | | | | | | | | | Since IMAGE_LINGUAS defaults to 'en-us en-gb' and since localization is not needed on this type of purpose-specific initramfs image, reset the variable which helps by shaving off almost 700kB from resulting bundled zImage-initramfs artifact. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: Add base-passwd packageniko.mauno@vaisala.com2020-09-121-0/+1
| | | | | | | | | | | | | | | | | | | | | This removes following boot-time complaints from udevd regarding missing group declarations: [ 6.624454] udevd[163]: specified group 'tty' unknown [ 6.625340] udevd[163]: specified group 'dialout' unknown [ 6.625692] udevd[163]: specified group 'kmem' unknown [ 6.626022] udevd[163]: specified group 'input' unknown [ 6.626541] udevd[163]: specified group 'video' unknown [ 6.626977] udevd[163]: specified group 'audio' unknown [ 6.627532] udevd[163]: specified group 'lp' unknown [ 6.628187] udevd[163]: specified group 'disk' unknown [ 6.628558] udevd[163]: specified group 'cdrom' unknown Size impact of this change on resulting bundled zImage-initramfs artifact is less than +1kB which is neglible. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-initramfs-image: Cosmetic improvementsniko.mauno@vaisala.com2020-09-121-9/+11
| | | | | | | | | - revise declaration ordering as suggested by oe-stylize.py - sort PACKAGE_INSTALL entries in alphabetic order - split long command line in deploy_verity_hash() Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: Use initramfs-frameworkniko.mauno@vaisala.com2020-09-123-61/+3
| | | | | | | | | | | | | | | Switch from this layer's initramfs-dm-verity recipe to poky-provided initramfs-framework suite to manage veritysetup et al. This commit also removes initramfs-dm-verity recipe which is not referred from elsewhere in this meta layer. Also update the install path of dm-verity.env from /usr/share to /usr/share/misc in order to better comply with FHS3.0, see https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework: Add dmverity moduleniko.mauno@vaisala.com2020-09-122-0/+69
| | | | | | | | | | | | Add 'initramfs-module-dmverity' as an extension to poky upstream provided initramfs-framework suite via matchingly named bbappend file. Together with pre-existing 'initramfs-module-udev' this module can be used to facilitate dm-verity rootfs mounting from initramfs context that is bundled with Linux kernel. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: Stage verity.env fileniko.mauno@vaisala.com2020-09-122-4/+8
| | | | | | | | | | | | | | | | | | | | Introduce new STAGING_VERITY_DIR variable specific to this bbclass which defines the directory where the verity.env file is stored during <DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE> task and can consequtively be picked up into associated initramfs rootfs (which facilitates executing 'veritysetup' and related actions). By doing this we mitigate failures that were thus far associated to this facility, such as install: cannot stat '.../build/tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.ext4.verity.env': No such file or directory and install: cannot stat '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity.env': No such file or directory Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto(-dev): Add dm-verity fragment as neededniko.mauno@vaisala.com2020-09-122-0/+2
| | | | | | | | Add checks that include dm-verity specific kernel config fragment when dm-verity-img.bbclass is used. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 08:41:00 +0000