summaryrefslogtreecommitdiffstats
path: root/meta-integrity/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* ima-policy: Fix S=UNPACKDIRArmin Kuster2024-07-313-3/+3
| | | | | | Drop BP , these are files not src bundle Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-simple: set SMikko Rapeli2024-07-311-0/+2
| | | | | | | Build with latest poky fails without it Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-appraise-all: set SMikko Rapeli2024-07-311-0/+2
| | | | | | | Build with latest poky requires it Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-hashed: set SMikko Rapeli2024-07-311-0/+2
| | | | | | | Build with latest poky fails without Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-simple: UNPACKDIR fixMikko Rapeli2024-07-311-1/+1
| | | | | | | New poky uses UNPACKDIR instead of WORKDIR Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-appraise-all: UNPACKDIR fixMikko Rapeli2024-07-311-1/+1
| | | | | | | New poky uses UNPACKDIR instead of WORKDIR Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-hashed: Start WORKDIR -> UNPACKDIR transitionWang Mingyu2024-06-171-1/+1
| | | | | | | Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* *.patch: add Upstream-Status to all patchesMartin Jansa2023-06-251-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | There is new patch-status QA check in oe-core: https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a This is temporary work around just to hide _many_ warnings from optional patch-status (if you add it to WARN_QA). This just added Upstream-Status: Pending everywhere without actually investigating what's the proper status. This is just to hide current QA warnings and to catch new .patch files being added without Upstream-Status, but the number of Pending patches is now terrible: 0 (0%) meta-parsec N/A (0%) meta-hardening 1 (100%) meta-integrity 15 (68%) meta-tpm 27 (61%) meta-security Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: Update ima-evm-utils to v1.5 and add a patchStefan Berger2023-05-062-2/+42
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the ima_policy_appraise_all to appraise executables & librariesStefan Berger2023-05-061-1/+8
| | | | | | | | | Fix the ima_policy_appraise_all policy to appraise all executables and libraries. Also update the list of files that are not appraised to not appraise cgroup related files. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: disable documentation from buildMikko Rapeli2023-03-261-0/+1
| | | | | | | | Building documentation fails due to missing asciidoc, xsltproc etc so it's better to just disable building them by default. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: Update to 1.4Armin Kuster2022-05-234-181/+2
| | | | | | | | | | | | | Switch from git to https in SRC_URI Drop patches not upstreamed. Passes OEQA: RESULTS - ima.IMACheck.test_ima_enabled: PASSED (1.05s) RESULTS - ima.IMACheck.test_ima_hash: PASSED (6.13s) RESULTS - ima.IMACheck.test_ima_overwrite: PASSED (131.31s) RESULTS - ima.IMACheck.test_ima_signature: PASSED (69.03s) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-keys: don't use lnrArmin Kuster2022-03-111-1/+1
| | | | | | | | | | | | lnr is a script in oe-core that creates relative symlinks, with the same behaviour as `ln --relative --symlink`. It was added back in 2014[1] as not all of the supported host distributions at the time shipped coreutils 8.16, the first release with --relative. However the oldest coreutils release in the supported distributions is now 8.22 in CentOS 7, so lnr can be deprecated and users switched to ln. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: Convert to new override syntaxArmin Kuster2021-08-015-11/+11
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: drop IMA_POLICY from policy recipesMing Liu2021-04-023-21/+6
| | | | | | | | | | | | IMA_POLICY is being referred as policy recipe name in some places and it is also being referred as policy file in other places, they are conflicting with each other which make it impossible to set a IMA_POLICY global variable in config file. Fix it by dropping IMA_POLICY definitions from policy recipes Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-keys: add file-checksums to IMA_EVM_X509Ming Liu2021-03-181-0/+1
| | | | | | | | This ensures when a end user change the IMA_EVM_X509 key file, ima-evm-keys recipe will be rebuilt. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagicMing Liu2021-03-021-0/+3
| | | | | | | | | | | This fixes following systemd boot issues: [ 7.455580] systemd[1]: Failed to create /init.scope control group: Permission denied [ 7.457677] systemd[1]: Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object. [ 7.459270] systemd[1]: Freezing execution. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-keys: add recipeMing Liu2021-02-231-0/+16
| | | | | | | Create a recipe to package IMA/EMV public keys. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: set native REQUIRED_DISTRO_FEATURES to emptyMing Liu2021-02-231-0/+1
| | | | | | | | 'ima' does not have to be in native DISTRO_FEATURES, unset it to avoid sanity check for ima-evm-utils-native. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: fix issues with yocto-check-layerArmin Kuster2020-01-044-1/+12
| | | | | | | [v2] re-did solutions Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: bump to release 1.2.1Dmitry Eremin-Solenikov2019-08-045-182/+3
| | | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: refresh xattr patchlumag2019-08-041-2/+2
| | | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: bump versionlumag2019-08-041-1/+1
| | | | | | | | Currently selected SRCREV (782224f33cd711050cbf6146a12122cd73f9136b) comes after 1.1 ima-evm-utils release, so bump PV accordingly. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: update to tipArmin Kuster2019-06-261-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* policy: add ima appraise all policyArmin Kuster2019-05-282-0/+47
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima_policy_simple: add another sample policyArmin Kuster2019-05-282-0/+22
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-policy-hashed: add new recipeArmin Kuster2019-05-282-0/+97
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: cleanup and update to tipArmin Kuster2019-05-286-22/+200
| | | | | | | | update to tip backported patches to fix build issues. fix native support Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: port over from meta-intel-iot-securityArmin Kuster2019-05-285-0/+201
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 20:11:48 +0000