aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-08-28fail2ban: remove Py2 and updatewipArmin Kuster
remove patch included in update fix issues do to python3 fix init file Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28scapy: update to 2.4.3Armin Kuster
remove python2 support Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28libenv-perl: Remove, moved to meta-perlAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28xmlsec1: Remove, moved to meta-oeAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28ecryptfs-utils: fix race condition in do_installQi.Chen@windriver.com
The rootsbindir is a self-defined directory. The install-rootsbinPROGRAMS is actually treated as part of install-data instead of install-exec. Do making install-exec-am depend on it actually results in the following Makefile contents. install-data-am: install-rootsbinPROGRAMS install-exec-am: install-binPROGRAMS install-binSCRIPTS @$(NORMAL_INSTALL) $(MAKE) $(AM_MAKEFLAGS) install-exec-hook install-exec-hook: install-rootsbinPROGRAMS And this results in race condition as two install commands of the same file running at the same time. Error message is like below. TOPDIR/tmp-glibc/hosttools/install: cannot create regular file 'TOPDIR/tmp-glibc/work/aarch64-wrs-linux/ecryptfs-utils/111-r0/image/sbin/mount.ecryptfs': File exists Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28ecryptfs-utils: remove openssl PACKAGECONFIGQi.Chen@windriver.com
ecryptfs-utils does not build with openssl1.1. Previously this openssl PACKAGECONFIG is disabled by default, so we are not getting build failures by default. But if we enable it, we get do_compile failure. This package is from ubuntu source, and the one ubuntu ships does not depend on openssl. The development of this package has stopped for about 3 years. I don't see it will fix the build offically. So remove this PACKAGECONFIG and use '--disable-openssl' directly. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24integrity-image: IMA_EVM_KEY_DIR has no affect, removeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24apparmor: update to 2.13.3Armin Kuster
create the cache dir at install time Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24apparmor: fix RDPENDSArmin Kuster
apparmor-2.13.2-r0 do_package_qa: QA Issue: /usr/bin/aa-easyprof contained in package apparmor requires /usr/bin/python3, but no providers found in RDEPENDS_apparmor? [file-rdeps] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24openscap: add runtime dependency on bash and python3-coreYi Zhao
Fixes: ERROR: QA Issue: /usr/bin/oscap-ssh contained in package openscap requires /bin/bash, but no providers found in RDEPENDS_openscap? [file-rdeps] ERROR: QA Issue: /usr/bin/scap-as-rpm contained in package openscap requires /usr/bin/python3, but no providers found in RDEPENDS_openscap? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24linux-stable: rename to more generic bbappendArmin Kuster
use wildcards Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24smack: add runtime dependency on python3-coreMartin Jansa
* fixes: ERROR: QA Issue: /usr/share/smack/smack_rules_gen contained in package smack requires /usr/bin/python3, but no providers found in RDEPENDS_smack? [file-rdeps] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-24openscap: fix scap-security-guide build errorYi Zhao
It would fail to build scap-security-guide when use openscap-native sstate cache. Steps to reproduce: Create a new build project: $ bitbake openscap-native $ bitbake openscap-native -c clean $ bitbake scap-security-guide Error message: OpenSCAP Error: Schema file 'xccdf/1.1/xccdf-schema.xsd' not found in path '/buildarea/build/tmp/work-shared/openscap/oscap-build-artifacts/usr/share/openscap/schemas' when trying to validate '/buildarea/build/tmp/work/core2-64-poky-linux/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/build/chromium/xccdf-unlinked-resolved.xml' [/buildarea/build/tmp/work/x86_64-linux/openscap-native/1.3.1+gitAUTOINC+4bbdb46ff6-r0/git/src/source/validate.c:104] Invalid XCCDF Checklist (1.1) content in /buildarea/build/tmp/work/core2-64-poky-linux/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/build/chromium/xccdf-unlinked-resolved.xml. [/buildarea/build/tmp/work/x86_64-linux/openscap-native/1.3.1+gitAUTOINC+4bbdb46ff6-r0/git/src/source/oscap_source.c:346] chromium/CMakeFiles/generate-internal-chromium-xccdf-unlinked-resolved.xml.dir/build.make:63: recipe for target 'chromium/xccdf-unlinked-resolved.xml' failed When using sstate cache, the openscap-native doesn't install the artifacts to work-shared/openscap/oscap-build-artifacts when prepare recipe sysroot for scap-security-guide. Set do_install[nostamp] to 1 to ensure the openscap-native artifacts are installed to work-shared/openscap/oscap-build-artifacts even if using sstate cache. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15linux-yocto-dev: update to use kernel cacheArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15linux-yocto: use 4.19 kernel cache nowArmin Kuster
remove kernel fragments now that they are in the kernel-cache for 4.19 update bbappend accordingly. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15linux-stable/5.2: add stable bbappendArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15meta-integrity: remove kernel fragments now in cacheArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15linux-%: remove kernel fragments now in cacheArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-11xmlsec1: upgrade 1.2.27 -> 1.2.28Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07layer.conf: switch to keyutils from meta-oeDmitry Eremin-Solenikov
As pointer by Martin Jansa, keyutils package is now a part of meta-oe, so switch to using keyutils from that layer. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07scap-security-guide: fix typoYi Zhao
Fix typo: RDEPNEDS_${PN} -> RDEPENDS_${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07openscap: cleanup DEPENDSYi Zhao
Remove autoconf-archive from DEPENDS because it is using CMake/Ninjia build now. Also remove unused dpkg-native dependency from DEPENDS_class-native. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07linux: add support for kernel modules signingDmitry Eremin-Solenikov
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
2019-08-07kernel-modsign.bbclass: add support for kernel modules signingDmitry Eremin-Solenikov
Add bbclass responsible for handling signing of kernel modules. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> fixup class to avoid including in every configure task Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04ima-evm-utils: bump to release 1.2.1Dmitry Eremin-Solenikov
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASEDmitry Eremin-Solenikov
data/debug-keys will be reused for demo modsign keys, so rename IMA_EVM_BASE to more generic INTEGRITY_BASE. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
2019-08-04scap-security-guide: update recipeYi Zhao
* Set B="${S}/build" to fix the build failure for out of source directory * Remove do_complile and do_install. Use the default functions from cmake.bbclass. * Install the artifacts to /usr/share rather than /usr/local/share Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04openscap: update recipeYi Zhao
* Add PACKAGECONFIG for gcrypt, nss3 and selinux * Use EXTRA_OECMAKE rather than EXTRA_OECONF * Set CMAKE_SKIP_RPATH and CMAKE_SKIP_INSTALL_RPATH instead of chrpath * Remove ptest since there are many host contamination issues on target. We will add it back when these issues are solved. * Drop the unused patch * Add PV Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04tpm2-tcti-uefi: build and install examplesDmitry Eremin-Solenikov
Examples are usefull to actually check TPM2 from UEFI shell. Add them to tpm2-tcti-uefi package. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04tpm2-tcti-uefi: stop inserting host directories into build pathDmitry Eremin-Solenikov
Do not insert /usr/lib and /usr/lib64 into LDFLAGS. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04tpm2-tcti-uefi: fix configure argumentsDmitry Eremin-Solenikov
Pass correct location of EFI's crt0 and ld script. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04tpm2-tcti-uefi: add autoconf-archive-native dependencyDmitry Eremin-Solenikov
Add dependency on autoconf-archive-native to receive AX_* macro definitions. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04tpm2-tss: fix compilation when using updated AX_CODE_COVERAGE macroDmitry Eremin-Solenikov
New autoconf-archive comes with updated AX_CODE_COVERAGE macro, which is not compatible with current tpm2-tss source base. Apply upstream patch to fix this incompatibility. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04packagegroup-security-tpm2: stop including tpm2-tcti-uefiDmitry Eremin-Solenikov
tpm2-tcti-uefi is a EFI module, so it should not be included in the rootfs. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04ima-evm-utils: refresh xattr patchlumag
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04ima-evm-utils: bump versionlumag
Currently selected SRCREV (782224f33cd711050cbf6146a12122cd73f9136b) comes after 1.1 ima-evm-utils release, so bump PV accordingly. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04layer.conf: add dependency on meta-securitylumag
ima-evm-utils recipe depends on keyutils recipe which is a part of meta-security layer. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04keyutils: remove from meta-securityArmin Kuster
now in meta-oe Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04samhain: update to 4.3.3Armin Kuster
remove PV from recipes names to make package update easier. PV set in include file now drop samhain-cross-compile.patch as stripping appears to have been removed. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04waf-cross-answers: remove filesArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04libldb: remove recipeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17meta-security-compliance: add meta-pythonArmin Kuster
with some for the recipe updates, more pyton support is needed Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17scap-security-guide: update to 0.1.44Armin Kuster
create a PV version to track upstream git version includes OE changes Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17openscap: add 1.3.1 recipes for upstream sourceArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17openscap_git: update to 1.3.0Armin Kuster
removed unneeded patch convert over to cmake refactor files Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07openscap/scap-security-guide: use _git instead of versioned filenamesMark Asselstine
In order to facilate the reuse of the recipe code via layer or distro specific bbappends rename the recipe files to use _git instead of versined filenames. Specifically this allows for minimal bbappends in additional layers which may use the upstream, non-forked, repos that can be version skewed when compared to what is present in this repo. Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07meta-security-compliance: update READMEArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07lynis: update to 2.7.5Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26kernel: Add conditional inclusion of fragments for linux-yocto-devHe Zhe
Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26clamav: minor recipe cleanupArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-16 22:40:46 +0000