Commit Graph

386 Commits

Author SHA1 Message Date
Armin Kuster d2b9de25cb packagegroup-core-security: remove clamav from musl image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 496a734c14)
2020-10-16 07:24:06 -07:00
Armin Kuster 59e5512023 packagegroup-core-security: dont include suricata on riscv or ppc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit caf76696e8)
2020-10-16 07:16:29 -07:00
Jonatan Pålsson 369a7bd129 sssd: Make manpages buildable
Some XML related fixes are needed to make the sssd manpages buildable

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 5efa53b2b2)
2020-10-16 07:14:24 -07:00
Kai Kang 9fdaf248f5 sssd: disable build secrets
It requires http_parser.h to build secrets:

| configure: error:
| You must have the header file http_parser.h installed to build sssd
| with secrets responder. If you want to build sssd without secret responder
| then specify --without-secrets when running configure.

The header file is from package http-parser[1] rather than apache2. But
there is no recipe http-parser in openembedded. So disable build secrets
for sssd and remove related systemd service and socket files.

Reference:
1. https://github.com/nodejs/http-parser

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 7831969f8c)
2020-10-16 07:14:05 -07:00
Armin Kuster 36d732f97c packagegroup-core-security: remove libseccomp for riscv*
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 29f47b4485)
2020-10-16 07:06:46 -07:00
Armin Kuster bb321aa1d7 libsecomp: rv32/rv64 target builds are not supported yet
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b5a5cbe1f5)
2020-10-16 07:06:23 -07:00
Armin Kuster a1d933f457 packagegroup-core-security: remove clamav for riscv*
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 98ff502d40)
2020-10-16 07:05:47 -07:00
Armin Kuster 3f6a0ff540 packagegroup-core-security-ptest: update fail2ban ptest pkg name
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit a2a102b2de)
2020-10-16 06:46:49 -07:00
Zheng Ruoqin 0b69bd3553 bastille: Deleted redundant inherit to fix error when enable multilib.
There is no need to inherit module-base. Because this inherit will stop
bastille to build to lib32-bastille.

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14 21:27:35 -07:00
Jonatan Pålsson 47de50efdb sssd: Add infopipe PACKAGECONFIG
infopipe was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-infopipe is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson e54b07c3d4 sssd: Add missing DEPENDS on jansson
When building with the curl PACKAGECONFIG, sssd will depend on the
jansson library.

Fixes the following error:
    | checking for JANSSON... no
    | checking jansson.h usability... no
    | checking jansson.h presence... no
    | checking for jansson.h... no
    | configure: error:
    | You must have the header file jansson.h installed to build sssd
    | with secrets and KCM responder. If you want to build sssd without
    these
    | responders then specify --without-secrets --without-kcm when running
    configure.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson cf423c05bf sssd: Add missing files to SYSTEMD_SERVICE
These files are installed when the ssh or curl PACKAGECONFIGs are enabled.

Fixes the following error:

    ERROR: sssd-1.16.4-r0 do_package: QA Issue: sssd: Files/directories were
      installed but not shipped in any package:
        /lib/systemd/system/sssd-kcm.socket
        /lib/systemd/system/sssd-kcm.service
        /lib/systemd/system/sssd-ssh.socket
        /lib/systemd/system/sssd-ssh.service

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 52e3654d34 sssd: Add sudo PACKAGECONFIG
sudo was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-sudo is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 79d9fc23e2 sssd: Add autofs PACKAGECONFIG
autofs was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-autofs is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 70a4908a97 sssd: Sort PACKAGECONFIG entries
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 5b82f67c48 buck-security: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 7beb91332f checksecurity: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster a9e3b04576 checksec: move to recipe-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster e4a2dd0b4a clamav: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster d2c383fa63 fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 4229f5025e libseccomp: update to 2.4.3
dropped patch now included in update

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Armin Kuster 96737082ad sssd: python2 not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson 6eaee464bf sssd: DEPEND on nss if nothing else is chosen
sssd will attempt to build against nss if no crypto is selected. If a
bbappend sets PACKAGECONFIG = <list without nss or crypto>, the
appropriate DEPEND is not established.

Fixes the following configure error:

    ... snip ...
    | checking for NSS... configure: error: Package requirements (nss) were not met:
    |
    | No package 'nss' found
    |
    | Consider adjusting the PKG_CONFIG_PATH environment variable if you
    | installed software in a non-standard prefix.
    |
    | Alternatively, you may set the environment variables NSS_CFLAGS
    | and NSS_LIBS to avoid the need to call pkg-config.
    | See the pkg-config man page for more details.
    |
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson 1c22721eae sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson a509e21902 sssd: Add PACKAGECONFIG for python2
Fixes the following build error:

    .. snip ..
    | checking for python2... no
    | checking for python3... (cached) python3.8
    | configure: error:
    | The program python2 was not found in search path.
    | Please ensure that it is installed and its directory is included in the search
    | path. It is required for building python2 bindings. If you do not want to build
    | them please use argument --without-python2-bindings when running configure.
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:12:59 -07:00
Kai Kang 4375507f39 sssd: fix for ldblibdir and systemd etc
Fix sssd issue for ldblibdir, systemd, pam etc.

* fix ldblibdir which is not calculated right for cross compile
* create directory /var/log/sssd which is required by sssd daemon
* disable building python2 binding
* fix pam module path
* update systemd configure options and service files

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-05 08:06:51 -08:00
Armin Kuster 17b0f42647 secuirty*-image: remove dead var and minor cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 290b4bbf8c clamav-native: missed bison fix
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 73cb9a32dc clamav: add bison-native to depend
fixes build issue:
clamav/0.101.5-r0/git/config/ylwrap: line 176: yacc: command not found

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 2a91f5cc62 google-authenticator-libpam: install module in pam location
pam_google_authenticator.so was being installed where pam could not find
it. Move it where the rest of the pam modules site.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:49:20 -08:00
Armin Kuster 238b8936e6 python3-fail2ban: add 2-3 conversion changes
Had to use the fail2ban-2.3 program to create py3 code
Add it as a patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:48:43 -08:00
Armin Kuster 2df5bbcf17 bastille: convert to py3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-10 19:13:52 -08:00
Armin Kuster 2732ab1467 ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-02 08:38:43 -08:00
Armin Kuster 037adba72e buck-security: fix rdebends and minor style cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster 3e9b32c714 checksecurity: fix runtime issues
add some missing perl modules

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Pierre-Jean Texier via Lists.Yoctoproject.Org 4c98f16973 google-authenticator-libpam: upgrade 1.07 -> 1.08
See changelog: https://github.com/google/google-authenticator-libpam/releases/tag/1.08

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster b02f3fae9d python3-fail2ban: update to latest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:57 -08:00
Armin Kuster fa8d29bffc sssd: drop py2 support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:20 -08:00
Armin Kuster b72cc7f87c fail2ban: fix runtime error
use success/failure calls in initd/function

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-05 16:09:44 -08:00
Armin Kuster 912ead8099 clamav: update to 0.101.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-03 11:54:58 -08:00
Armin Kuster 6b42f1c033 google-authenticator-libpam: update to 1.07
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster 4786213cab python3-fail2ban: include python-fail2ban.inc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster 36ebd09b06 python-fail2ban: Drop python2 package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Yi Zhao 2c2161fbc2 libseccomp: upgrade 2.4.1 -> 2.4.2
Backport a patch to fix ptest build failure on arm64.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-16 20:51:00 -08:00
Ming Liu fa800e5261 meta: inherit features_check instead of distro_features_check
distro_features_check has been deprecated in OE.

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson 484d13bc59 clamav: add tmpfiles.d config
This is needed to ensure freshclam's /var/log directory and file are
created when using systemd.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson b111206c4c checksecurity: use more portable find args
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Armin Kuster c55721b15e checksec: add missing rdepends to readelf
update test to check for depends

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-14 22:45:18 -07:00
Scott Ellis 46549c0ea5 ncrack: update to tip
LIC_FILES_CHKSUM changed do to the date bumped to 2018 to 2019.

The license is the same as nmap and the nmap recipe in meta-openembedded
has that beginline/endline grab stuff.

Went for consistency as ncrack is an nmap project.

Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-29 16:13:30 -07:00
Armin Kuster 546aca7e8a packagegroup-core-security: update package name
Also remove tpm packagegroup reference

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00