summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tpm2-pkcs11: Add tools python runtime dependenciesHEADwalnascarmasterOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | | | | | | The tpm2-pkcs11-tools python module is importing several modules which are not currently included in it's dependencies. This causes the script invocation to fail. The current commit adds the relevant dependencies, to ensure that the python module is always able to run. The relevant dependencies are: * python3-fcntl: To add the fcntl module, imported in db.py. * python3-sqlite3: To add the sqlite3 module, imported in db.py. * python3-tpm2-pytss: To add the tpm2_pytss module, imported in utils.py. * python3-compression: To add the zipfile module, imported through "importlib.metadata import distribution" in tpm2_ptool. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pytss: Add python3-asn1crypto runtime dependencyOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | The tpm2-pytss module is importing the module asn1crypto in tsskey.py, however, the current bitbake recipe is not including this python package as runtime dependency. This causes the module invocation to fail at the moment. The commit adds this dependency to the bitbake recipe, to make the recipe self contained. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pcr-extend: fix config errorArmin Kuster2025-04-131-0/+2
| | | | | | | | | Skip configure step to fix this error: pcr-extend-0.1+git-r0 do_configure: no configure script found at ../git/configure There is no configure for this package. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: fix build error introduced by upstream commitArmin Kuster2025-04-131-0/+12
| | | | | | | | | | 7a2b9acef2 cargo: pass PACKAGECONFIG_CONFARGS to cargo build error: unexpected argument '--with-libcap_ng-includes' found | | Usage: cargo build --verbose... --target [<TRIPLE>] --release --manifest-path <PATH> --offline Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: enable unprivileged service user featureYi Zhao2025-04-131-4/+10
| | | | | | | | | | | The unprivileged service user feature has been improved in 2.10 to allow running the sssd service as an unprivileged user [1]. So enable this feature, and then we can run the service as the unprivileged user sssd. [1] https://github.com/SSSD/sssd/releases/tag/2.10.0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: upgrade 2.9.2 -> 2.10.2Yi Zhao2025-04-135-559/+18
| | | | | | | | | | | | ChangeLog: https://github.com/SSSD/sssd/releases/tag/2.10.2 * Drop backport patches. * Update sssd.conf and volatile files. * Drop PACKAGECONFIG[infopipe] as it has been removed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgssglue: add ptestYi Zhao2025-04-132-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ptest result: ptest-runner libgssglue START: ptest-runner 2025-03-27T13:15 BEGIN: /usr/lib64/libgssglue/ptest PASS: gss_create_empty_oid_set PASS: gss_test_oid_set_member PASS: gss_test_oid_set_member n==0 PASS: gss_add_oid_set_member() OK PASS: gss_test_oid_set_member() OK OID present in set with the OID added to it => 1 PASS: gss_test_oid_set_member() OK PASS: gss_test_oid_set_member() OK Another OID present in set without the OID => 0 PASS: gss_test_oid_set_member() OK PASS: gss_add_oid_set_member() OK PASS: gss_test_oid_set_member() OK Another OID present in set with it added => 1 PASS: gss_test_oid_set_member() OK PASS: gss_test_oid_set_member() OK First OID present in set => 1 PASS: gss_test_oid_set_member() OK PASS: gss_release_oid_set() OK PASS: gss_indicate_mechs() OK PASS: gss_release_oid_set() OK PASS: gss_import_name() OK PASS: gss_display_name() OK display_name() => 27: imap@server.example.org@FOO PASS: gss_release_buffer() OK PASS: gss_release_name() OK Basic self tests done with 0 errors DURATION: 0 END: /usr/lib64/libgssglue/ptest 2025-03-27T13:15 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libgssglue: upgrade 0.8 -> 0.9Yi Zhao2025-04-132-64/+2
| | | | | | | * Drop useless patch libgssglue-canon-name.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: upgrade 4.4.10 -> 4.5.2Yi Zhao2025-04-1315-118/+168
| | | | | | | | | | ChangeLog: https://fossies.org/linux/samhain/docs/Changelog * Refresh patches Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-yamlpath: upgrade 3.8.0 -> 3.8.2Changqing Li2025-04-131-1/+6
| | | | | | | | | | | | | | | | | | | | | | | Release note: Enhancements: The MergerConfig class now accepts overrides for config values as "keys" and "rules" keyword arguments to the constructor. Credit and my thanks go to https://github.com/leviem1! BREAKING CHANGES: Support for Python 3.6 has been dropped. This is forced by incompatibilities discovered with the latest version of pytest and because dependencies like dateutil and ruamel-yaml-clib no longer support Python 3.6. Support for Python 3.7 is tepid. While pytest is still working with Python 3.7, other dependencies are no longer supporting Python 3.7; however, the extensive tests for yamlpath show no issues with them, so far. For now, Python 3.12 support is pending, waiting for the dateutil library to resolve a DeprecationWarning regarding its use of datetime.datetime.utcfromtimestamp(). Refer: https://pypi.org/project/yamlpath/3.8.2/ Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-xmldiff: upgrade 2.6.3 -> 2.7.0Changqing Li2025-04-131-1/+8
| | | | | | | | | | | | | | | | | | Changes: 2.7.0 (2024-05-13) * Changed the comparison to make accurate and standard more accurate, although fast gets less accurate as a result. * Changed usage of deprecated pkg_resources package to importlib.metadata. * A use_replace flag was added to the XMLFormatter by Thomas Pfitzinger. It changes text replacement from delete and insert tags to a replace tag. It’s not currently accessaible thtough the CLI, the question is it is better to add a new formatter name, or an option to pass in formatter flags. - Added option to XMLFormatter to use replace tags - in _make_diff_tags after diffing, neighboring delete/insert diffs are joined to a replace tag - the deleted text is added as an attribute (“old-text”) - the inserted text is the element’s text Refer: https://pypi.org/project/xmldiff/2.7.0/ Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhtp: update to 0.5.50Armin Kuster2025-04-132-152/+2
| | | | | | drop CVE-2024-45797.patch now included Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update to walnascar (5.2) layer/release seriesArmin Kuster2025-04-131-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: upgrade 0.1.75 -> 0.1.76Yi Zhao2025-04-131-1/+1
| | | | | | | | ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.76 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss-engine: add .so symmlink to engines packageAdrian Freihofer2025-04-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Without the symlink, the engine is not found by openssl: openssl engine -t -c tpm2tss 20F0C5BDFFFF0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:/usr/src/debug/openssl/3.2.4/crypto/dso/dso_dlfcn.c:118: filename(/usr/lib/engines-3/tpm2tss.so): /usr/lib/engines-3/tpm2tss.so: cannot open shared object file: No such file or directory ... With sym-link it works (also without extra configuration for openssl) cd /usr/lib/engines-3/ ln -s libtpm2tss.so tpm2tss.so openssl engine -t -c tpm2tss (tpm2tss) TPM2-TSS engine for OpenSSL [RSA, RAND] [ available ] For exmample also the Fedora package has the symlink. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-openssl: update to 1.3.0Michael Haener2025-04-131-2/+2
| | | | | Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: upgrade 0.1.74 -> 0.1.75Yi Zhao2025-03-121-1/+1
| | | | | | | | ChangeLog: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: upgrade 1.4.0 -> 1.4.1Yi Zhao2025-03-121-1/+1
| | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/OpenSCAP/openscap/releases/tag/1.4.1 * Introduce "oscap-im" - script that can be used in Containerfiles to build hardened bootable container images to run as Image Mode Operating System * Add support for containers with no entrypoint/cmd in "oscap-docker" * Stop printing useless component reference information in "oscap info" * Fix missing declaration of PATH_MAX on Solaris * Fix RPM database path in RPM probes (RHEL-55251, #2151) * Fix issues reported by OpenScanHub after 1.4.0 release * Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x architecture * Ensure xlink namespace exists (RHEL-34104) * Minor fixes in test suite and CI Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: set sparse as "never" during initial file copyLorenzo Arena2025-03-121-1/+1
| | | | | | | | | This is needed when a verity image is used in conjunction with tools like a WIC and a bmap file, as avoiding writing "sparse" sectors can result in errors in the signature verification. Signed-off-by: Lorenzo Arena <arena.lor@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Enable choice of creating IMA signatures or hashesStefan Berger2025-03-122-2/+9
| | | | | | | | | | | | | | | | | | | When IMA and EVM are used for file appraisal then EVM verifies the signature stored in security.evm. This signature covers file metadata (uid, gid, mode bits, etc.) as well as the security.ima xattr. Therefore, it is sufficient that only files' hashes are stored in security.ima. This also leads to slight performance improvements since IMA appraisal will then only verify that a file's hash matches the expected hash stored in security.ima. EVM will ensure that the signature over all the file metadata and security.ima xattr is correct. Therefore, give the user control over whether to store file signatures (--imasig) in ima.security or hashes (--imahash) by setting the option in IMA_EVM_IMA_XATTR_OPT. Only test-verify an IMA signature if --imasig is used as the option. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: update to 3.1.4Armin Kuster2025-02-021-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security: Remove True option to getVar callsakash hadke2025-02-022-3/+3
| | | | | | | | getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: musl don't build apparmorArmin Kuster2025-01-062-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: drop firejail for muslArmin Kuster2025-01-061-1/+1
| | | | | | | appears to be a known issue: https://bugs.gentoo.org/937374 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* .gitlab-ci: speed up parsec buildsArmin Kuster2025-01-061-4/+4
| | | | | | build parsec image not the larger generic security image Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: add pipeline badgeArmin Kuster2025-01-061-0/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-service: fix build errorArmin Kuster2025-01-062-0/+52
| | | | | | | | | | | Fixes: | error: unnecessary qualification | --> src/front/domain_socket.rs:247:30 | | | 247 | let ucred_size = mem::size_of::<ucred>(); | | ^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: tweak to improve CI work flowArmin Kuster2025-01-062-0/+5
| | | | | | | drop ptest from base builds. Enable ptest in test image only Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update from 0.8.2 to 0.10.0Mikko Rapeli2024-12-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improves error reporting among other things. Changes: https://github.com/stefanberger/swtpm/releases/tag/v0.10.0 version 0.10.0: swtpm: Requires libtpms v0.10.0 Display tpmstate-opt-lock as a new capability Add support for lock option parameter to tpmstate option nvstore_linear: Add support for file-backend locking Remove broken logic to check for neither dir nor file backend Use ptm_cap_n to build PTM_GET_CAPABILITY response Define a structure to return PTM_GET_CAPABILITY result Implement --print-info to run TPMLIB_GetInfo with flags Support --profile fd= to read profile from file descriptor Support --profile file= to read profile from file Ignore remove-disabled parameter on non-'custom' profile Check for good entropy source in chroot environment Implement a check for HMAC+sha1 for testing future restriction Implement function to check whether a crypto algorithm is disabled Print cmdarg-print-profiles as part of capabilities Check whether SHA1 signature support is disabled in profile Use TPMLIB_WasManufactured to check whether profile was applied Determine whether OpenSSL needs to be configured (FIPs, SHA1 signature) Add support for --print-profiles option Print profile names as part of capabilities JSON Display new capability to allow setting a profile Add support for --profile option to set a profile on TPM 2 swtpm_setup: Comment flags for storage primary key and deprecate --create-spk Implement --print-profiles to display all profile Add profile entries to swtpm_setup.conf written by swtpm_setup Add support for --profile-name option Accept profiles with name starting with 'custom:' Support default profile from file in swtpm_setup.conf Support --profile-file-fd to read profile from file descriptor Support --profile-file to read profile from file Always log the active profile Implement --profile-remove-fips-disabled option Read default profile from swtpm_setup.conf Print profile names as part of capabilities JSON Add support for --profile parameter Get default rsa keysize from setup_setup.conf if not given swtpm_ioctl: Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response selinux: Change write to append for appending to log Add rule for logging to svirt_image_t labeled files from swtpm_t tests: Update IBMTSS2 test suite to v2.4.0 Test activation of PCR banks when not all are available Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with profile Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file Consolidate custom profile test cases and check for StateFormatLevel Convert test_samples_create_tpmca to run installed Mention test_tpm2_libtpms_versions_profiles requiring env. variables allow running ibmtss2 tests against installed version Derive support for CUSE from SWTPM_EXE help screen Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test Extend test case testing across libtpms versions Add test case for testing profiles across libtpms versions Test the --profile option of swtpm_setup and swtpm teach them to run installed add installed-runner.sh install tests on the system lookup system binaries if INSTALLED is set build-sys: enable 64-bit file API on 32-bit systems Add -Wshadow to the CFLAGS Require that libtpms v0.10 is available for TPMLIB_SetProfile debian: Add rule to allow usage of /var/tmp directory (QEMU) Add rules for reading profiles from distro and local dirs Allow non-owner file write access in /var/lib/libvirt/swtpm/ Add sys_admin capability to apparmor profile https://github.com/stefanberger/swtpm/releases/tag/v0.9.0 version 0.9.0: Note: The SElinux policy for swtpm was completely redone. For systems with an SELinux policy the same policy (>= 40.17) as used in Fedora >= 40 is required due to changes in labels related to libvirt that made the re-development of the SELinux policy necessary. swtpm: Use umask() to create/truncated state file rather than fchmod() Use fchmod to set mode bits provided by user Replace mkstemp with g_mkstemp_full (Coverity) fix typo in help message cuse: Fix Coverity complaints regarding locks Fix double free in error path Close fd after main loop Restore logging to stderr on log open failure swtpm_setup: Fail --pcr-banks without --tpm2 Fail --decryption or --allow-signing without --tpm2 Initialized argv in get_swtpm_capabilities() Flush spk after persisting to create room for another key Refactor duplicate code into swtpm_tpm2_write_cert_nvram Move persisting of certificate into tpm2_persist_certificate Pass key_type to function creating filename for key Add scheme parameter before curveid to createprimary_ecc Rename is_ek to preserve for future extension Mask-out EK and plaform certificate flags and set cert_flags Move common code into new function read_certificate_file() Exit with '0' upon --version rather than '1' Close file descriptors passed to swtpm process on parent side Make stdout unbuffered Use medium duration on TSC_PhysicalPresence to avoid timeouts Add poll() after write() and before read() to detect errors swtpm_localca: Add support for up to 20 bytes serial numbers Introduce --key as more generic alias for --ek Add missing NULL option to end of array Make stdout unbuffered swtpm_cert: Add support for serial numbers up to 20 bytes long swtpm_ioctl: Separate return code from flags Repeatedly call PTM_GET_INFO for long responses selinux: Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install) New SELinux policy that requires Fedora 40 or later tests: Fixed occurrences of stray '' before '-' Rearrange order of test cases to run some also as 'root' Add tests for command line options and combinations of options Add softhsm_setup to shellcheck'ed files and fix issues Add missing 'exit 1' on unexpected file size on --reconfigure Add test cases for swtpm_cert with max serial number Fix spelling mistakes reformat regexs for easier readability and extension ibmtss2: Add patch to disable x509 test with older libtpms Upgrade to ibmtss2 v2.0.1 Fixed several issues detected by shellcheck build-sys: Add support for --disable-tests to disable tests Display GMP_LIBS and GMP_CFLAGS Only display warning if pkg-config for gmp fails Add gmp library and devel package as dependency use PKG_CHECK_MODULES to check libtpms version rpm: Add gmp library and devel package as dependency Split off SELinux files to build an selinux package debian: Sync AppArmor profile with what is used by Ubuntu Add gmp library and devel package as dependency Allow apparmor access to qemu session bus swtpm files Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpms: set CVE_PRODUCTMikko Rapeli2024-12-271-0/+2
| | | | | | | | | | Using vendor "libtpms_project" and product "libtpms" as in https://nvd.nist.gov/vuln/detail/CVE-2021-3446 Matches CVEs better when analyzing with cve_check.bbclass. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: rename to libtpmsMikko Rapeli2024-12-273-2/+2
| | | | | | | | Upstream and other distros like Debian use package name libtpms so use this name for recipe too to match CVEs etc. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: update from 0.9.6 to 0.10.0Mikko Rapeli2024-12-271-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Needed by newer swtpm. Improves error messages etc. Changes: https://github.com/stefanberger/libtpms/releases/tag/v0.10.0 version 0.10.0: tpm2: Support for profiles: default-v1 & custom tpm2: Add new API call TPMLIB_SetProfile to enable user to set a profile tpm2: Extende TPMLIB_GetInfo to return profiles-related info tpm2: Implemented crypto tests and restrictions on crypto related to FIPS-140-3; can be enabled with profiles tpm2: Enable Camellia-192 and AES-192 tpm2: Implement TPMLIB_WasManufactured API call tpm2: Fixes for issues detected by static analyzers tpm2: Use OpenSSL-based KDFe implementation if possible tpm2: Update to TPM 2 spec rev 183 (many changes) tpm2: Better support for OpenSSL 3.x tpm2: Use Carmichael function for RSA priv. exponent D (>= 2048 bits) tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018 tpm2: Fix of SignedCompareB(). NOTE: This fix may result in backwards compatibility issues with PCR policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when upgrading from v0.9 to v0.10. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oeqa runtime clamav.py: use curl if ping failsMikko Rapeli2024-12-271-1/+1
| | | | | | | | | | TEST_RUNQEMUPARAMS = "slirp" does not pass ping through but UDP and TCP will work. Thus curl the http website even if the response is DoS blocker and not the real website. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: update from 3.1.3 to 4.0.3Mikko Rapeli2024-12-272-4/+78
| | | | | | | | | | | | | | Fixes python 3.13 support though needed one more patch which is also submitted upstream. oeqa runtime test passes on qemuarm and qemuarm64. Did not fix ptest compilation. Changes: https://apparmor.net/news/release-4.0.2/ https://gitlab.com/apparmor/apparmor/-/releases/v4.0.3 Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-alt.yml: fix systemd configMikko Rapeli2024-12-271-1/+1
| | | | | | | | Adding "systemd" to DISTRO_FEATURES does not work anymore and build failes due to udev selection etc issues. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oeqa runtime ima.py: skip without "integrity" in DISTRO_FEATURESMikko Rapeli2024-12-271-0/+1
| | | | | | | ima and meta-integrity are not enabled without and the test fails. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oeqa runtime clamav.py: skip test_freshclam_download with systemdMikko Rapeli2024-12-271-0/+2
| | | | | | | | | systemd service files already start a download at boot which locks the files and thus the test fails. Instead of this test, with systemd it is sufficient to check that all systemd services succeeded. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: depend on ecryptfs kernel moduleMikko Rapeli2024-12-271-1/+4
| | | | | | | | ecryptfs-utils userspace daemon fails to start if kernel module is not available on target. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: enable ecryptfsMikko Rapeli2024-12-271-0/+1
| | | | | | | | | | Build ecryptfs as module. Needed by userspace counterparts in ecryptfs-utils which are currently failing to start correctly and thus downgrading systemd boot status from RUNNING to DEGRADED. Fix is to build and install the kernel module. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd-boot: enable TPM support via "tpm2" in DISTRO_FEATURESMikko Rapeli2024-12-271-0/+7
| | | | | | | systemd-boot will then measure boot components to TPM device. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd: enable TPM supportMikko Rapeli2024-12-271-0/+17
| | | | | | | | | | | | Enable "tpm2" support if "tpm2" is in DISTRO_FEATURES. Also enable cryptsetup, openssl and repart features which are needed to use TPM device to encrypt filesystems with systemd configuration. See: https://www.freedesktop.org/software/systemd/man/latest/systemd-repart.html#--tpm2-device= Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* u-boot: enable TPM support via "tpm2" in MACHINE_FEATURESMikko Rapeli2024-12-271-1/+1
| | | | | | | | "tpm2" is used elsewhere in distro and machine featues to enable TPM device support. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: add dependency to efivarMikko Rapeli2024-12-271-1/+1
| | | | | | | | | | | | | | Without this there is a floating dependency which can fall back to build host and possibly fail if header file is found but shared library not. Without this change do_configure log shows: checking for efivar... no checking for efivar/efivar.h... no ../tpm2-tools-5.7/configure: line 15461: efivar: command not found Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: drop python pkgsArmin Kuster2024-12-221-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* harden.conf: drop debug-tweaksArmin Kuster2024-12-171-1/+1
| | | | | | | | | | | Use the new root/pswd directives Signed-off-by: Armin Kuster <akuster808@gmail.com> --- V2] use new primary definitions
* drop: debug-tweaks from ciArmin Kuster2024-12-161-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chkroot: update to 0.58bArmin Kuster2024-12-161-2/+3
| | | | | | LIC_FILES_CHKSUM changed due to yr update. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: set staging correctly in case basename has changedLouis Rannou2024-12-161-2/+2
| | | | | | | | | | Fix the verity class when the IMAGE_BASENAME has changed. Prefer DM_VERITY_IMAGE for staging env and wic fragment so it matchs what is used in the dm-verity-image-initramfs and the base wks systemd-bootdisk-dmverity.wks.in. Signed-off-by: Louis Rannou <louis.rannou@non.se.com> Signed-off-by: Louis Rannou <louis.rannou@syslinbit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-img.bbclass: add DM_VERITY_SETUP_ARGSgr embeter2024-12-161-0/+4
| | | | | | | | | Useful to pass additional arguments to veritysetup, for example '--no-superblock' to make system less vulnerable to certain types of attacks and data maniputaion on the disk. Signed-off-by: Grygorii Tertychnyi <grembeter@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity-image-initramfs: drop lvm2-udevrulesYi Zhao2024-11-241-1/+1
| | | | | | | | | | Drop lvm2-udevrules as it has been removed in meta-openembedded commit[1]. [1] https://git.openembedded.org/meta-openembedded/commit/?h=master&id=c37c867e1adddd6fa39cf3f3d4c6688ea6dc825a Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-13 03:24:07 +0000