aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-08-23layer.con: add DISTROOVERIDE for hardeningmaster-wipArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-08-23meta-harden: Add a layer to demo harding OE/YPArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-08-17trousers: Several Security fixesArmin Kuster
Fixes: CVE-2020-24332 CVE-2020-24330 CVE-2020-24331 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-08-04libseccomp: fix cross compile error for mipsKai Kang
Backport patch to fix cross compile error for mips: | syscalls.h:44:6: error: expected identifier or '(' before numeric constant | 44 | int mips; | | ^~~~ Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-08-04clamav: add INSTALL_CLAMAV_CVD flag to do_installCharlie Davies
Recipe provides INSTALL_CLAMAV_CVD flag to bypass clamav cvd db creation. During do_install this flag should be used to conditionally skip install of cvd db if needed. Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27packagegroup-core-security: restore riscv64 for libssecompArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27libseccomp: update to 2.5.0Armin Kuster
Notable changes: Add support for the 64-bit RISC-V architecture Update the syscall tables to Linux v5.8.0-rc5 Python bindings and build now default to Python 3.x for more info see: https://github.com/seccomp/libseccomp/blob/master/CHANGELOG Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27packagegroup-core-security: remove libseccomp for riscv*Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27libsecomp: rv32/rv64 target builds are not supported yetArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25packagegroup-core-security: remove clamav for riscv*Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25packagegroup-security-tpm: add more packages for buildingArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25security packagegroups: move to recipes-coreArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25security images: Move to recipe-coreArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25ibmswtpm2: upgrade 1563 -> 1628Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25lynis: update to 3.0.0Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-24drop ci-build: it is hiding errorsArmin Kuster
call kas from .gitlab-ci fix typos add missing mips64 file add main layer workaround Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-19kas: add ima, tpm and tpm2 build configsArmin Kuster
for qemux86, qemux86-64 and qemuarm64 Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18add gitlab framework and qemu machineArmin Kuster
Machines: qemux86 qemux86-64 qemuarm qemuarm64 qemuppc qemumips84 qemuriscv64 Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18meta-integrity: add dynamic-layer for strongswanArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18strongswan: Add bbappends for ima changesArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18layer.conf: add dynamic-layer for strongswanArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18strongswan: add bbappends for tpm changesArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18python3-privacyidea: adding initial support for mfaArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-18python3-oauth2client: add recipeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14packagegroup-security-tpm2: Depend on preferred provider for cryptsetupJeremy Puhlman
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-devJeremy Puhlman
Without this we get weird conflict when you include dev packages: rror: Transaction check error: file /usr/include/libcryptsetup.h conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib64/libcryptsetup.so conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib64/pkgconfig/libcryptsetup.pc conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib/libcryptsetup.so conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib/pkgconfig/libcryptsetup.pc conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14bastille: Deleted redundant inherit to fix error when enable multilib.Zheng Ruoqin
There is no need to inherit module-base. Because this inherit will stop bastille to build to lib32-bastille. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14ccs-tools:Fix build error when enable multilib.Zheng Ruoqin
ERROR: lib32-ccs-tools-1.8.4-r0 do_install: oe_runmake failed ERROR: lib32-ccs-tools-1.8.4-r0 do_install: Execution of '/build-armv8/tmp/work/armv7ahf-neon-mllib32-linux-gnueabi/lib32-ccs-tools/1.8.4-r0/temp/run.do_install.22368' failed with exit code 1: make: *** No rule to make target 'install'. Stop. WARNING: exit code 1 from a shell command. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-06isafw.bbclass: typo in layer nameArmin Kuster
move class to proper layer Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-06packagegroup-core-security-ptest: update fail2ban ptest pkg nameArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-06suricata: update to 4.1.8Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-23sssd: disable build secretsKai Kang
It requires http_parser.h to build secrets: | configure: error: | You must have the header file http_parser.h installed to build sssd | with secrets responder. If you want to build sssd without secret responder | then specify --without-secrets when running configure. The header file is from package http-parser[1] rather than apache2. But there is no recipe http-parser in openembedded. So disable build secrets for sssd and remove related systemd service and socket files. Reference: 1. https://github.com/nodejs/http-parser Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19apparmor: pull in coreutils/findutils only when not using systemd as init ↵Alexander Kanavin
manager The utilities from those packages (xargs, comm) are only used in sysvinit scripts, and so there is no need to pull them in when systemd is in use. Both are gpl3 licensed, so this is beneficial for builds where gpl3 is not allowed. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tripwire: Remove makefiles from the man directories.Jeremy Puhlman
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19clamav: resolve multilib issuesJeremy Puhlman
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tpm2-tcti-uefi: drop patch no longer neededArmin Kuster
drop tpm2-get-caps-fixed.patch, tss update negated the need for this change. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19openscap: update to 1.3.3Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19libtpm: update to 0.7.2Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tpm2-pkcs11: update 1.2.0Armin Kuster
add yaml package Updated LICNESE Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tpm2-tss-engine: add branch to SRC_URI & update to tipArmin Kuster
LICENSE changed to BSD 3 Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tpm2-tss: update to 2.4.1Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19tpm2-tools: update to 4.1.3Armin Kuster
LICENSE changed to BSD3 Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15samhain: dnmalloc hash fix for aarch64 and mips64Haseeb Ashraf
fix runtime error: samhain[4069]: FATAL: x_dnmalloc.c: 2790: hashval < AMOUNTHASH Killed The proper fix is not to disable dnmalloc. This change is in continuation of samhain-mips64-aarch64-dnmalloc-hash-fix.patch which requires CONFIG_ARCH_AARCH64 or CONFIG_ARCH_MIPS64 to be defined for the corresponding architecture Signed-off-by: Haseeb Ashraf <Haseeb_Ashraf@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15samhain-server: add volatile file for systemdYi Zhao
Add volatile file to create /var/log/yule when using systemd. Also remove unused /var/log directory in do_install. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15dm-verity: add a working example for BeagleBone BlackBartosz Golaszewski
This adds various bits and pieces to enable generating a working example of a full chain of trust up to dm-verity-protected rootfs level on Beagle Bone Black. The new initramfs is quite generic and should work for other SoCs as well when using fitImage. The following config can be used with current master poky, meta-openembedded & meta-security to generate a BBB image using verified boot and dm-verity. UBOOT_SIGN_KEYDIR = "/tmp/test-keys/" UBOOT_SIGN_KEYNAME = "dev" UBOOT_SIGN_ENABLE = "1" UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" UBOOT_MACHINE_beaglebone-yocto = "am335x_boneblack_vboot_config" IMAGE_CLASSES += "dm-verity-img" IMAGE_FSTYPES += "wic.xz ext4" DM_VERITY_IMAGE = "core-image-full-cmdline" DM_VERITY_IMAGE_TYPE = "ext4" KERNEL_CLASSES += "kernel-fitimage" KERNEL_IMAGETYPE_beaglebone-yocto = "fitImage" IMAGE_INSTALL_remove = " kernel-image-zimage" IMAGE_BOOT_FILES_remove = " zImage" IMAGE_BOOT_FILES_append = " fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE};fitImage" # Using systemd is not strictly needed but deals nicely with read-only # filesystem by default. DISTRO_FEATURES_append = " systemd" DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "systemd-compat-units" INITRAMFS_IMAGE = "dm-verity-image-initramfs" INITRAMFS_FSTYPES = "cpio.gz" INITRAMFS_IMAGE_BUNDLE = "1" WKS_FILE = "beaglebone-yocto-verity.wks.in" KERNEL_FEATURES_append = " features/device-mapper/dm-verity.scc" Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15classes: provide a class for generating dm-verity meta-data imagesBartosz Golaszewski
This adds a class that allows to generate conversions of ext[234] and btrfs partitions images with dm-verity hash data appended at the end as well as a corresponding .env file containing the root hash and data offset that can be stored in a secure location (e.g. signed fitImage) or signed and verified at run-time on its own. The class depends on two variables: DM_VERITY_IMAGE: defines the name of the main image (normally the one that is used with the bitbake command to build the main image) DM_VERITY_IMAGE_TYPE: defines exactly one type for which to generate the protected image. Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15buck-security: fix runtime issue with missing per moduleArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-04-07apparmor: update to 2.13.4Jan Luebbe
Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-04-07apparmor: fix wrong executable permission on service fileJan Luebbe
This avoids "systemd[1]: Configuration file /lib/systemd/system/apparmor.service is marked executable. Please remove executable permission bits. Proceeding anyway." on boot. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27arpwatch: add new recipeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-20 00:46:28 +0000