Add ld option '-z noexecstack' for cryptfs-tpm2 to fix link warnings:
ld: warning: secret_area.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Update SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Fixes:
encrypt_secret.py -i "H31i05" > "primary_key.secret" || exit 1
ERROR: Unable to encrypt the secret
Suggested-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
When LDFLAGS expands, The -fmacro-prefix-map and -fdebug-prefix-map will
be prefixed with -Wl, which will cause compilation error:
ld: -f may not be used without -shared
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
The current soname of libcryptfs-tpm2 is libcryptfs-tpm2.so:
$ readelf -d libcryptfs-tpm2.so.0.7.0 | grep SONAME
0x000000000000000e (SONAME) Library soname: [libcryptfs-tpm2.so]
The libcryptfs-tpm2.so is a symbolic link of libcryptfs-tmp2.so.0.7.0
and it is not installed by default because it is packaged to dev
package. Then we will encounter an error when run command cryptfs-tpm2:
$ cryptfs-tpm2
cryptfs-tpm2: error while loading shared libraries: libcryptfs-tpm2.so:
cannot open shared object file: No such file or directory
$ ldd cryptfs-tpm2 | grep libcryptfs-tpm2
libcryptfs-tpm2.so => not found
Set the soname to libcryptfs-tpm2.so.$(MAJOR_VERSION) to fix the issue.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Convert the script to python3 to fix the do_compile failure.
Fixes:
/buildarea/poky/build/tmp/work/core2-64-poky-linux/cryptfs-tpm2/0.7.0+gitAUTOINC+888c46c827-r0/git/scripts/encrypt_secret.py -i "H31i05" > "primary_key.secret" || exit 1
/usr/bin/env: ‘python’: No such file or directory
Makefile:64: recipe for target 'primary_key.secret' failed
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
The initrd takes care of starting the luks volumes and activing the
dmcrypt udev rules. The udev rule required a modification to deal
with volumes that had already been started, else the cold plug event
that runs at user space startup puts the dmcrypt device into a state
that systemd cannot manage it.
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
The lvm2-udevrules is required else udev will never perform the device
notification when an encrypted volume is initially created.
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
The device nodes are in a different place when using the swtpm + ovfm
+ qemu. The luks-setup.sh needs to look in an additional location to
properly support qemu.
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and
`9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core,
update LAYERSERIES_COMPAT `sumo' -> `thud'
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
The following commits are reverted by the way:
- seloader: Fix building for rocko (bc6bbe2)
- meta-integrity: rpm: Add back in required patches for rocko (5fa9c85)
Because they are only applicable to rocko.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
SECURITY_LDFLAGS includes -fstack-protector-strong which cannot work
with CCLD. To work around this issue, filter out it from LDFLAGS.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Now cryptfs-tpm2 supports both TSS 1.x and 2.x API.
Please specify "TSS2_VER=1" in EXTRA_OEMAKE to support 1.x API.
Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
when configuring lvm2 without udev, lvm2-udevrules package is empty,
causing do_rootfs failure.
Error:
ERROR: wrlinux-image-glibc-std-1.0-r5 do_rootfs: Function failed: do_rootfs
Problem: conflicting requests
- nothing provides lvm2-udevrules needed by cryptsetup-1.7.4-r0.corei7_64
Move lvm2-udevrules from RDEPEND to RRECOMMENDS could workaround the issue.
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* install 'packagegroup-tpm2-initramfs' of distro flag 'tpm2' is set
* install 'initrdscripts-ima' if distro flag 'ima' is set
* install 'cryptfs-tpm2-initramfs' if distro flag 'luks' is set
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
meta-oe layer split the udevrules for lvm2 into a new package.
Add lvm2-udevrules into cryptsetup RDEPENDS list.
Signed-off-by: Jiang Lu <lu.jiang@windriver.com>
${COREBASE}/LICENSE is not a valid license file. So it is recommended
to use '${COMMON_LICENSE_DIR}/MIT' for a MIT License file in
LIC_FILES_CHKSUM. This will become an error in the future.
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
encrypted-storage layer will include more security features about encrypted
storage so the term "encrypted-storage" won't be used to specify a dedicated
technology term such as "LUKS".
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
Mingli Yu
Yi Zhao
Kai Kang
Jia Zhang
Bartłomiej Burdukiewicz
Yongxin Liu
richard
Christophe Priouzeau
Robert Yang
Jason Wessel
muvarov
Hongxu Jia
Yunguo Wei
Tom Rini
Trevor Woerner
Wenzong Fan
WarrickJiang
Jia Zhang
Lans Zhang