There is already a BBFILE_COLLECTIONS named integrity in
meta-security/meta-integrity layer, which will casue conflicts.
Rename BBFILE_COLLECTIONS to integrity-layer.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
linux-yocto-integrity.inc is shared among linux-yocto linux-yocto-rt and
linux-yocto-dev and cannot be found with ${BPN} in the latter two.
ERROR: ParseError at layers/meta-secure-core/meta-integrity/recipes-kernel/linux/linux-yocto-dev.bbappend:1:
Could not include required file linux-yocto-dev-integrity.inc
ERROR: ParseError at layers/meta-secure-core/meta-integrity/recipes-kernel/linux/linux-yocto-rt_5.%.bbappend:1:
Could not include required file linux-yocto-rt-integrity.inc
Signed-off-by: He Zhe <zhe.he@windriver.com>
This is the result of automated script conversion:
poky/scripts/contrib/convert-variable-renames.py meta-secure-core
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Operations like XXX:append += "YYY" are almost always wrong and this
is a common mistake made in the metadata. Improve them to use the
standard format.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Update SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
enable this plugin will cause undeterministic build. whether to build
audit plugin depends on whether libaudit exists on the host
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Add back the append override, as the '+=' operator will make the
default value of BB_HASHBASE_WHITELIST in oe-core not have any
effect.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Since rpm 4.15, the users can control over the installation of
signatures on config files through a variable named
%_ima_sign_config_files. But this is disabled by default. Add a macro
configuration file to enable it.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Fix the following warning:
[INFO]: the following symbols were not found in the active configuration:
- CONFIG_IMA_NG_TEMPLATE=y
Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
Currently, an error will be thrown when trying to use a GPG homedir whose path
length exceeds 80 characters. This limitation can be worked around by providing
libassuan socket redirection files for "S.gpg-agent.yocto-native",
"S.gpg-agent.ssh", "S.gpg-agent.browser" and "S.gpg-agent.extra"
sockets. The redirection files will point to the real sockets in /tmp
directory. The sockets will be automatically cleaned up by gpg agent.
References:
[1] https://dev.gnupg.org/T1752
[2] https://gnupg.org/documentation/manuals/assuan.pdf
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Fixes:
* Use glibc header instead of libattr header because the attr/xattr.h
has been removed from attr package.
* fix configure check for newer libimaevm versions.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Currently, the PACKAGECONFIG assignment in rpm-integrity might overwrite
the previous contents of the variable.
Similar to systemd_%.bbappend and ovmf_%.bbappend, use _append to add
"imaevm" to PACKAGECONFIG when distro feature ima is enabled.
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
connect to gpg agent may failed due to the GPG_PATH is too long,
check and raise an error if the length is greater than 80.
Signed-off-by: Liwei Song <liwei.song@windriver.com>
do_rootfs
in commit 393b80fa, prefuncs of do_package_write_rpm/do_rootfs
have been replace by (task)_prepend in this bbclass, so remove it.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
This changes the rpm signing setup to use a generic routine
check_gpg_key(), in order that the boot loader gpg signing can use the
same infrastructure.
For now the boot loader gpg signing will only support grub and
introduces the variable:
GRUB_SIGN_VERIFY = "1"
This variable is a control point to activate the code in grub-efi to
perform file verification of any file it loads against a gpg key which
is linked into the boot loader with grub-mkimage. It will also cause
all the other files such as the kernel, initramfs and LockDown.efi to
be signed such that grub will verify the files.
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Due to the following reasons, need to add the dependency to
task who needs to run check_rpm_public_key:
* packagegroup recipe don't have task prepare_recipe_sysroot
* varflags depends don't work for prefuncs
Signed-off-by: Changqing Li <changqing.li@windriver.com>
there is a scenario that this bbclass is enabled globally,
all targets will inherit sign_rpm_ext. but this bbclass
need gpg to work, on some new distro like
ubuntun 19.04, gpg is not installed, so compile will failed.
fail cmd:
cmd = '%s --batch --homedir %s --passphrase %s --import %s' % \
(gpg_bin, gpg_path, d.getVar('RPM_GPG_PASSPHRASE', True), gpg_key)
error:
base-files-3.0.14-r89 do_package_write_rpm: Failed to import gpg key (): /bin/sh: 1: --batch: not found
Signed-off-by: Changqing Li <changqing.li@windriver.com>
When using rpmsign (with --signfiles --fskpath) to sign RPM package,
the IMA signature is not correct, see:
$ getfattr -d -m - rootfs/usr/sbin/grpconv
file: rootfs/usr/sbin/grpconv
security.ima=0sAwIEDy1SEQP3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
And the expected signature is like this:
$ getfattr -d -m - rootfs/usr/sbin/grpconv
file: rootfs/usr/sbin/grpconv
security.ima=0sAwIEDy1SEQEAA6s8DwmRCVutcrE8NvHWWYXlg8L1AwH5teu44prkKRwmhZQ52Oa4UQoZZlxER/SJ9tijbve8ZAv++KW8EqgP4iZjEGh8ke76rpiRU5glnG/U+HUjnilJBpzpMJHxyNbAiFoHMESeCOtrhY0zZIUXK3DnIuIJSwpfl2HaNFxRrE38EaqgV9IQ8QiWFCvgDYXoJDwc3KdhjKjs214tCfZpKO1w4QJl2n4llZHw2RTHIuUOsMhRDEXs6onLHmdmhvqgxIHt7IvsT9v7H8GnoaiX0xgzxk2o/mE5EtPrnMtUoGSQwdY8CAfUbCwAp0c5QlsrHk5RBmewjJ/jxd/K1uKp7w==
The root cause is libimaevm doesn't retrieve correct signing algo, so this patch
is making things right.
Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
Since commit [b41010c linux-yocto-integrity: fix modsign key path] applied,
if MODSIGN_ENABLED is "0", bbclass user-key-store will not be inherited
which causing 'uks_modsign_keys_dir' is not defined
Unconditionally inherit user-key-store, but conditionally invoke
uks_modsign_keys_dir
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Use modsign key directly from uks_modsign_keys_path(d), rather than from
installed package.
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
The bb.build.FuncFailed had been removed in bitbake with commit
cfeffb602dd5319f071cd6bcf84139ec77f2d170. Use bb.fatal instead of it.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Run yocto-check-layer-wrapper to check layer compliance of Yocto will report the signatures error:
util-linux:do_compile: 9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374 ->
53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99
bitbake-diffsigs --task util-linux do_compile --signature
9c04caa1d37ca0fa0caa2f48a01912d1b3d35de2ac668c4cddd6158bbac9c374
53de68708253461d617177c02a60d0e798f5f7727c14cc8e6b9a8bbedc53de99
Rename util-linux_%.bbappend to util-linux-integrity.inc and add a new
bbappend. Make sure this piece of code should be applied only if the ima
feature is set.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
This reverts commit 0477a93cf9.
Run yocto-check-layer-wrapper to check layer compliance of Yocto will report the signatures error:
rpm-native:do_configure: c2221ee127ea61f99a6062ffadb1fe05ca44b9200e38a91521a5a28d4f13140b ->
d955da8ce20c8dbc0c5bc9b7569dd459484b0e24ba1e4c66828a84e919025eca
bitbake-diffsigs --task rpm-native do_configure --signature
c2221ee127ea61f99a6062ffadb1fe05ca44b9200e38a91521a5a28d4f13140b
d955da8ce20c8dbc0c5bc9b7569dd459484b0e24ba1e4c66828a84e919025eca
Revert the patch to fix it.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Third party programs including libimaevm fails to build with musl
due to a missing include in the public header. Add it.
The build with glibc is unaffected. Patch sent upstream.
Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
When the meta-integrity layer is included but feature ima is not set, we
would get the following error when the system startup:
qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist.
qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32.
Rename base-files_%.bbappend to base-files-integrity.inc and add a new
bbappend. Make sure this piece of code should be applied only if the ima
feature is set.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
If sample keys are selected, key-store service will deploy IMA private
key during first boot, but beople may be confused if we deploy a sample
private key like "xxx.crt", so this commit is making sure key/cert on
target are consistent with key files on build system.
Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
We have a bbappend file which enables plugins for rpm. We need to
ensure to also disable the inhibit plugin for rpm-native. Otherwise,
we get the following warning at rootfs time.
Unable to get systemd shutdown inhibition lock: Socket name too long
The inhibit plugin tries to inhibit shutdown during rpm operation. It
obviously makes no sense for rpm-native, as 1) we may not build on a
systemd based host and 2) the build process does not affect the package
management on host.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and
`9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core,
update LAYERSERIES_COMPAT `sumo' -> `thud'
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
The following commits are reverted by the way:
- seloader: Fix building for rocko (bc6bbe2)
- meta-integrity: rpm: Add back in required patches for rocko (5fa9c85)
Because they are only applicable to rocko.
Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
