aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-core
AgeCommit message (Collapse)Author
2020-10-10packagegroup-core-security: remove clamav from musl imageArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09packagegroup-core-security: apparmor 3.0 ptest does not buildArmin Kuster
for now skip apparmor ptest Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09security-test-image: tweak to get more tests to runnArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09initramfs-framework/dmverity: add retry loop for slow boot devicesNaveen Saini
Detection of USB devices by the kernel is slow enough. We need to keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>) and sleep between each attempt (default: one second, rootdelay=<seconds>). Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4 Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01packagegroup-core-security-ptest: removeArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01security-test-image: simplifyArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01packagegroup-core-security-ptest: remove keyutils-ptestArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29packagegroup-core-security: add opendnssec to pkg grpArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29packagegroup-core-security: add libest packageArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29packagegroup-core-security: add softHSMArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18packagegroup-core-security: add more pkgs to base groupArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12packagegroup-core-security: dont include suricata on riscv or ppcArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-image-initramfs: Drop locales from imageniko.mauno@vaisala.com
Since IMAGE_LINGUAS defaults to 'en-us en-gb' and since localization is not needed on this type of purpose-specific initramfs image, reset the variable which helps by shaving off almost 700kB from resulting bundled zImage-initramfs artifact. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-image-initramfs: Add base-passwd packageniko.mauno@vaisala.com
This removes following boot-time complaints from udevd regarding missing group declarations: [ 6.624454] udevd[163]: specified group 'tty' unknown [ 6.625340] udevd[163]: specified group 'dialout' unknown [ 6.625692] udevd[163]: specified group 'kmem' unknown [ 6.626022] udevd[163]: specified group 'input' unknown [ 6.626541] udevd[163]: specified group 'video' unknown [ 6.626977] udevd[163]: specified group 'audio' unknown [ 6.627532] udevd[163]: specified group 'lp' unknown [ 6.628187] udevd[163]: specified group 'disk' unknown [ 6.628558] udevd[163]: specified group 'cdrom' unknown Size impact of this change on resulting bundled zImage-initramfs artifact is less than +1kB which is neglible. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-initramfs-image: Cosmetic improvementsniko.mauno@vaisala.com
- revise declaration ordering as suggested by oe-stylize.py - sort PACKAGE_INSTALL entries in alphabetic order - split long command line in deploy_verity_hash() Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-image-initramfs: Use initramfs-frameworkniko.mauno@vaisala.com
Switch from this layer's initramfs-dm-verity recipe to poky-provided initramfs-framework suite to manage veritysetup et al. This commit also removes initramfs-dm-verity recipe which is not referred from elsewhere in this meta layer. Also update the install path of dm-verity.env from /usr/share to /usr/share/misc in order to better comply with FHS3.0, see https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12initramfs-framework: Add dmverity moduleniko.mauno@vaisala.com
Add 'initramfs-module-dmverity' as an extension to poky upstream provided initramfs-framework suite via matchingly named bbappend file. Together with pre-existing 'initramfs-module-udev' this module can be used to facilitate dm-verity rootfs mounting from initramfs context that is bundled with Linux kernel. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-img.bbclass: Stage verity.env fileniko.mauno@vaisala.com
Introduce new STAGING_VERITY_DIR variable specific to this bbclass which defines the directory where the verity.env file is stored during <DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE> task and can consequtively be picked up into associated initramfs rootfs (which facilitates executing 'veritysetup' and related actions). By doing this we mitigate failures that were thus far associated to this facility, such as install: cannot stat '.../build/tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.ext4.verity.env': No such file or directory and install: cannot stat '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity.env': No such file or directory Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-image-initramfs: Bind at do_image insteadniko.mauno@vaisala.com
Bind custom actions in this image recipe in do_image() rather than do_rootfs(), which can help shaving even dozens of seconds from duration of 'bitbake <DM_VERITY_IMAGE>' command re-execution. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12dm-verity-image-initramfs: Ensure verity hash syncniko.mauno@vaisala.com
In order to ensure that the bundled initramfs always contains the most recently generated DM_VERITY_IMAGE specific root filesystems' root hash, we disable the timestamp for do_rootfs() task here, meaning that the task will be re-executed whenever some task that depends on it executes. Without this change, executing e.g. the following sequence $ bitbake <DM_VERITY_IMAGE> $ bitbake -c clean <DM_VERITY_IMAGE> $ bitbake <DM_VERITY_IMAGE> results in an unbootable <DM_VERITY_IMAGE> rootfs, which fails like Mounting /dev/vda over dm-verity as the root filesystem [ 8.729974] device-mapper: verity: sha256 using implementation sha256-generic [ 8.810784] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.813018] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.813912] Buffer I/O error on dev dm-0, logical block 2992, async page read Verity device detected corruption after activation. [ 8.889548] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.891060] device-mapper: verity: 253:0: metadata block 3017 is corrupted [ 8.891456] Buffer I/O error on dev dm-0, logical block 2992, async page read ... [ 9.135707] EXT4-fs (dm-0): unable to read superblock [ 9.142897] EXT4-fs (dm-0): unable to read superblock [ 9.145393] EXT4-fs (dm-0): unable to read superblock [ 9.147905] FAT-fs (dm-0): unable to read boot sector mount: /new_root: can't read superblock on /dev/mapper/rootfs. BusyBox v1.32.0 () multi-call binary. Usage: switch_root [-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS] [ 9.243274] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 [ 9.243701] CPU: 0 PID: 1 Comm: switch_root Not tainted 5.8.3-yocto-standard #1 [ 9.243853] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 ... [ 9.248548] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]--- Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27packagegroup-core-security: restore riscv64 for libssecompArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-27packagegroup-core-security: remove libseccomp for riscv*Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25packagegroup-core-security: remove clamav for riscv*Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25security packagegroups: move to recipes-coreArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-25security images: Move to recipe-coreArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-15dm-verity: add a working example for BeagleBone BlackBartosz Golaszewski
This adds various bits and pieces to enable generating a working example of a full chain of trust up to dm-verity-protected rootfs level on Beagle Bone Black. The new initramfs is quite generic and should work for other SoCs as well when using fitImage. The following config can be used with current master poky, meta-openembedded & meta-security to generate a BBB image using verified boot and dm-verity. UBOOT_SIGN_KEYDIR = "/tmp/test-keys/" UBOOT_SIGN_KEYNAME = "dev" UBOOT_SIGN_ENABLE = "1" UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" UBOOT_MACHINE_beaglebone-yocto = "am335x_boneblack_vboot_config" IMAGE_CLASSES += "dm-verity-img" IMAGE_FSTYPES += "wic.xz ext4" DM_VERITY_IMAGE = "core-image-full-cmdline" DM_VERITY_IMAGE_TYPE = "ext4" KERNEL_CLASSES += "kernel-fitimage" KERNEL_IMAGETYPE_beaglebone-yocto = "fitImage" IMAGE_INSTALL_remove = " kernel-image-zimage" IMAGE_BOOT_FILES_remove = " zImage" IMAGE_BOOT_FILES_append = " fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE};fitImage" # Using systemd is not strictly needed but deals nicely with read-only # filesystem by default. DISTRO_FEATURES_append = " systemd" DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit" VIRTUAL-RUNTIME_init_manager = "systemd" VIRTUAL-RUNTIME_initscripts = "systemd-compat-units" INITRAMFS_IMAGE = "dm-verity-image-initramfs" INITRAMFS_FSTYPES = "cpio.gz" INITRAMFS_IMAGE_BUNDLE = "1" WKS_FILE = "beaglebone-yocto-verity.wks.in" KERNEL_FEATURES_append = " features/device-mapper/dm-verity.scc" Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07busybox: fix sig changes when layer addedArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2015-04-15libseccomp: add testsArmin Kuster
update busybox for extend head option for test suite remove seq -f option as it is not supported buy busybox Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-27 18:47:51 +0000