aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-03-04ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagicgatesgarthMing Liu
This fixes following systemd boot issues: [ 7.455580] systemd[1]: Failed to create /init.scope control group: Permission denied [ 7.457677] systemd[1]: Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object. [ 7.459270] systemd[1]: Freezing execution. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wicMing Liu
Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04initramfs-framework-ima: let ima_enabled return 0Ming Liu
Otherwise, ima script would not run as intended. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04README.md: update according to the refactoring in ima-evm-rootfs.bbclassMing Liu
Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04meta: refactor IMA/EVM sign rootfsMing Liu
The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04initramfs-framework-ima: RDEPENDS on ima-evm-keysMing Liu
Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04ima-evm-keys: add recipeMing Liu
Create a recipe to package IMA/EMV public keys. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04initramfs-framework-ima: fix a wrong pathMing Liu
/etc/ima-policy > /etc/ima/ima-policy. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-04ima-evm-utils: set native REQUIRED_DISTRO_FEATURES to emptyMing Liu
'ima' does not have to be in native DISTRO_FEATURES, unset it to avoid sanity check for ima-evm-utils-native. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24kas-security-base: use gatesgarth nameArmin Kuster
drop DL_DIR Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24kas-security-base.yml: build setting updatesArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24scap-security-guide: Inherit python3targetconfigArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24openscap: Inherit python3targetconfigArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24python3-suricata-update: Inherit python3targetconfigArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-24apparmor: Inherit python3targetconfigArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-17.gitlab-ci: drop scriptArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-15kas-security-base: Don't create local SSTATE mirrorArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-15scap-security-guide: fix build with Python 3.9Yi Zhao
The getchildren and getiterator functions are deprecated in Python 3.9. Backport 3 patches to fix the build issue. Fixes: File "/build/tmp/work/cortexa8hf-neon-poky-linux-gnueabi/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/ssg/build_stig.py", line 41, in add_references index = rule.getchildren().index(ref) AttributeError: 'xml.etree.ElementTree.Element' object has no attribute 'getchildren' Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-04samhain: update to 4.4.2Armin Kuster
refresh a few patches too Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-04clamav: unify volatiles file nameYi Zhao
Make the volatiles file name starts with digital. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-04suricata: unify volatiles file nameYi Zhao
Make the volatiles file name starts with digital. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-19gitlab-ci: add building meta-security-compliance pkgsArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-19gitlab-ci: add meta-hardening build imageArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-19meta-security: Add gatesgarth to LAYERSERIES_COMPATArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15layer.conf: use += instead of := to update BBFILESSajjad Ahmed
Updating BBFILES with := isn't the standard way and can break parsing under certain conditions, instead use += which is widely used. Signed-off-by: Sajjad Ahmed <sajjad_ahmed@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15scap-security-guide: add expat-native to DEPENDSMingli Yu
Add expat-native to DEPENDS to fix the below do_configure error: | CMake Error at CMakeLists.txt:165 (message): | xmlwf is required! Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15tpm2-pkcs11: update to 1.4.0Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15tpm2-tools: update to 4.3.0Armin Kuster
LIC_FILES_CHKSUM changes do to added Copyright Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15tpm2-abrmd: update to 2.3.3Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15tpm2-totp: update to 0.2.1Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15tpm2-tss: update to 2.4.3Armin Kuster
includes: CVE-2020-24455 Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15gitlab-ci: add qemux86 and qemuarm64 musl buildsArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-15kas: fixup alt configsArmin Kuster
add smack Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10suricata: update to 4.1.9Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10packagegroup-core-security: remove clamav from musl imageArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10sssd: update to latest ltm 1.16.5Armin Kuster
fix musl support Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10libest: fix musl build.Armin Kuster
fixes est.c:38:10: fatal error: execinfo.h: No such file or directory | 38 | #include <execinfo.h> | | ^~~~~~~~~~~~ Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10ecryptfs-utils: fix musl buildArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10apparmor: fix build for on muslArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10qemux86-test: add apparmor backArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09suricata: fix compiling on gcc10Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09packagegroup-core-security: apparmor 3.0 ptest does not buildArmin Kuster
for now skip apparmor ptest Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09apparmor: update to 3.0Armin Kuster
skip ptest for now, on todo list for fix. Runtime test pass remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09security-test-image: tweak to get more tests to runnArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09apparmor: fix build issue with ptest enabled.Armin Kuster
minor spacing cleanup Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09linux-%/5.x: Add dm-verity fragment as neededNaveen Saini
Add checks that include dm-verity specific kernel config fragment when dm-verity-img.bbclass is used. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09wic: add wks.in for intel dm-verityNaveen Saini
Based on systemd-bootdisk-microcode.wks.in, this adds the dm-verity image similar to the beaglebone wks already in meta-security. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09initramfs-framework/dmverity: add retry loop for slow boot devicesNaveen Saini
Detection of USB devices by the kernel is slow enough. We need to keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>) and sleep between each attempt (default: one second, rootdelay=<seconds>). Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4 Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01packagegroup-core-security-ptest: removeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01security-test-image: simplifyArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-19 19:43:44 +0000