61 Commits

Author SHA1 Message Date
Scott Murray
0272225ccd Adapt to S/UNPACKDIR changes
Remove or update S definitions as required to work with oe-core
S/UNPACKDIR changes.

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:41:20 -04:00
Clayton Casciato
ef79062165 smack: Use new CVE_STATUS variable
Fix "CVE_CHECK_IGNORE is deprecated in favor of CVE_STATUS"

https://docs.yoctoproject.org/dev/ref-manual/variables.html#term-CVE_STATUS

Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:41:18 -04:00
J. S.
4e2b318a86 Fix warning : lack of whitespace around assignment
v2 : also fix some typos while we are here.
v3 : add fixes for isic and checksecurity

Signed-off-by: Jason Schonberg <schonm@gmail.com>
[removed already applied change]
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-07-04 12:40:38 -04:00
Mikko Rapeli
5c98ff10a6 apparmor: update from 3.1.3 to 4.0.3
Fixes python 3.13 support though needed one more patch
which is also submitted upstream. oeqa runtime test
passes on qemuarm and qemuarm64. Did not fix ptest compilation.

Changes:

https://apparmor.net/news/release-4.0.2/
https://gitlab.com/apparmor/apparmor/-/releases/v4.0.3

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-12-27 11:28:23 -05:00
Armin Kuster
9d38b8754f apparmor: fix QA Warnings
RROR: apparmor-3.1.3-r0 do_package_qa: QA Issue: File /usr/src/debug/apparmor/3.1.3/libraries/libapparmor/swig/perl/libapparmor_wrap.c in package apparmor-src contains reference to TMPDIR [buildpaths]
ERROR: apparmor-3.1.3-r0 do_package_qa: QA Issue: File /usr/lib/python3.12/site-packages/LibAppArmor/.debug/_LibAppArmor.cpython-312-aarch64-linux-gnu.so in package apparmor-dbg contains reference to TMPDIR [buildpaths]
ERROR: apparmor-3.1.3-r0 do_package_qa: QA Issue: File /usr/lib/perl5/vendor_perl/5.38.2/aarch64-linux/auto/LibAppArmor/.packlist in package apparmor contains reference to TMPDIR [buildpaths]
ERROR: apparmor-3.1.3-r0 do_package_qa: Fatal QA errors were found, failing task.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Armin Kuster
ca10975033 recipes-*: convert WORKDIR->UNPACKDIR
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Martin Jansa
e674c91b65 {tcp,udp}-smack-test: fix few more implicit-function-declaration issues fatal with gcc-14
tcp-smack-test:
tcp_server.c: In function 'main':
tcp_server.c:50:16: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]
   50 |         port = atoi(argv[1]);
      |                ^~~~
tcp_server.c:62:12: error: implicit declaration of function 'fsetxattr' [-Wimplicit-function-declaration]
   62 |         if(fsetxattr(sock, attr_in, label_in, strlen(label_in),0) < 0)
      |            ^~~~~~~~~

udp-smack-test:
udp_client.c: In function 'main':
udp_client.c:52:12: error: implicit declaration of function 'fsetxattr' [-Wimplicit-function-declaration]
   52 |         if(fsetxattr(sock, attr, label, strlen(label),0) < 0)
      |            ^~~~~~~~~
udp_client.c:67:9: error: implicit declaration of function 'close'; did you mean 'pclose'? [-Wimplicit-function-declaration]
   67 |         close(sock);
      |         ^~~~~
      |         pclose

udp_server.c: In function 'main':
udp_server.c:42:16: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]
   42 |         port = atoi(argv[1]);
      |                ^~~~
udp_server.c:57:12: error: implicit declaration of function 'fsetxattr' [-Wimplicit-function-declaration]
   57 |         if(fsetxattr(sock, attr, label, strlen(label), 0) < 0)
      |            ^~~~~~~~~
udp_server.c:84:9: error: implicit declaration of function 'close'; did you mean 'pclose'? [-Wimplicit-function-declaration]
   84 |         close(sock);
      |         ^~~~~
      |         pclose

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-01 07:07:49 -04:00
Martin Jansa
51b4468933 mmap-smack-test, smack-test, tcp-smack-test, udp-smack-test: don't use S = ${WORKDIR}
* fixes:
  Parsing recipes...
  ERROR: meta-security/recipes-mac/smack/mmap-smack-test_1.0.bb: Using S = ${WORKDIR} is no longer supported
  ERROR: meta-security/recipes-mac/smack/tcp-smack-test_1.0.bb: Using S = ${WORKDIR} is no longer supported
  ERROR: meta-security/recipes-mac/smack/udp-smack-test_1.0.bb: Using S = ${WORKDIR} is no longer supported
  ERROR: meta-security/recipes-mac/smack/smack-test_1.0.bb: Using S = ${WORKDIR} is no longer supported
  ERROR: Parsing halted due to errors, see error messages above

* see:
  https://lists.openembedded.org/g/openembedded-architecture/message/2007

* it's fatal error since:
  https://git.openembedded.org/openembedded-core/commit/?h=master&id=32cba1cc916ad530c5e6630a927e74ca6f06289b

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-06-17 08:25:25 -04:00
Martin Jansa
e4425bca52 {tcp,udp}-smack-test: fix implicit-function-declaration issues fatal with gcc-14
tcp-smack-test:
http://errors.yoctoproject.org/Errors/Details/766925/
  tcp_client.c:55:16: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]

udp-client-tests:
http://errors.yoctoproject.org/Errors/Details/766927/
  udp_client.c:41:16: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]
  udp_client.c:51:12: error: implicit declaration of function 'fsetxattr' [-Wimplicit-function-declaration]
  udp_client.c:66:9: error: implicit declaration of function 'close'; did you mean 'pclose'? [-Wimplicit-function-declaration]

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-06-17 08:25:25 -04:00
Lei Maohui
8ffa79641f ccs-tools: Fix do_package QA Issue.
After usrmerge had been enabled, paxctl has the fowllowing error:
ERROR: ccs-tools-1.8.9-r0 do_package: QA Issue: ccs-tools: Files/directories were installed but not shipped in any package:
  /sbin/ccs-init

Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-11 07:17:25 -04:00
Martin Jansa
405cca4028 .patch: remove probably unused patches
There could be some false possitives (the script is far from perfect), so please
test it on your QA, I've only double checked with "git grep" (the script looks
only in parent directory).

@ ~/layers/meta-security $ /OE/extra-layers/meta-ros/scripts/check-patch-files.sh .
./recipes-ids/tripwire/files/add_armeb_arch.patch: not used in any recipe
./dynamic-layers/meta-python/recipes-security/fail2ban/files/0001-To-fix-build-error-of-xrang.patch: not used in any recipe
./recipes-scanners/clamav/files/fix2_libcurl_check.patch: not used in any recipe
./recipes-scanners/arpwatch/files/postfix_workaround.patch: not used in any recipe
./meta-tpm/recipes-tpm/libtpm/files/Use-format-s-for-call-to-dprintf.patch: not used in any recipe
./meta-tpm/recipes-tpm/libtpm/files/fix_signed_issue.patch: not used in any recipe
./meta-tpm/recipes-tpm/libtpm/files/Convert-another-vdprintf-to-dprintf.patch: not used in any recipe
./meta-tpm/recipes-tpm/swtpm/files/fix_lib_search_path.patch: not used in any recipe
./meta-tpm/recipes-tpm/swtpm/files/fix_fcntl_h.patch: not used in any recipe
./recipes-mac/AppArmor/files/disable_perl_h_check.patch: not used in any recipe

@ ~/layers/meta-security $ git grep add_armeb_arch.patch
@ ~/layers/meta-security $ git grep 0001-To-fix-build-error-of-xrang.patch
@ ~/layers/meta-security $ git grep fix2_libcurl_check.patch
@ ~/layers/meta-security $ git grep postfix_workaround.patch
@ ~/layers/meta-security $ git grep Use-format-s-for-call-to-dprintf.patch
@ ~/layers/meta-security $ git grep fix_signed_issue.patch
@ ~/layers/meta-security $ git grep Convert-another-vdprintf-to-dprintf.patch
@ ~/layers/meta-security $ git grep fix_lib_search_path.patch
@ ~/layers/meta-security $ git grep fix_fcntl_h.patch
@ ~/layers/meta-security $ git grep disable_perl_h_check.patch

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Martin Jansa
df8a1eb479 *.patch: fix malformed Upstream-Status and SOB lines
* as reported by openembedded-core/scripts/contrib/patchreview.py -v .

Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/crosscompile_perl_bindings.patch)
Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/disable_perl_h_check.patch)

Missing Upstream-Status tag (./recipes-compliance/scap-security-guide/files/0001-standard.profile-expand-checks.patch)

Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-pid-path.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/suricata/files/fixup.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-scanners/clamav/files/fix2_libcurl_check.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/isic/files/configure_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/krill/files/panic_workaround.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libdns_conf_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libxml2_conf.patch

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster
21d8a4a187 apparmor: update to 3.1.3
drop debian patch as the file was dropped upstream.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster
852daaf67b apparmor: update to 3.0.7
Fix typo in HOMEPAGE

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 12:18:45 -04:00
Armin Kuster
a891026392 apparmor: update to 3.0.6
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:41 -07:00
Armin Kuster
a3500e01e2 apparmor: update to 3.0.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
94edbcea9a ccs-tools: update to 1.8.9
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
95f7abc7ef smack-test: more py3 covertion
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
b67b4cf5ca apparmor: fix ownership issues
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-18 06:48:22 -07:00
Armin Kuster
98df792565 smack-test: switch to python3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-07 16:58:24 -07:00
Joe Slater
93f2146211 LICENSE: update to SPDX standard names
Use convert-spdx-licenses.py to update LICENSE in recipes.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Armin Kuster
0272f7ff02 apparmor: update to 3.0.4
drop to patches no longer needed
use setuptools

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Armin Kuster
cc11c8c0ab smack: Use new CVE_CHECK_IGNORE variable
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:10:02 -08:00
Kai Kang
05ee41d3a5 apparmor: fix warning of remove operator combined with +=
Fix warning for apparmor:

| WARNING: /path/to/meta-security/recipes-mac/AppArmor/apparmor_3.0.1.bb:
|  RDEPENDS:${PN}:remove += is not a recommended operator combination,
|  please replace it.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-28 16:16:10 -08:00
Armin Kuster
7e27eb5fca recipes: Update SRC_URI branch and protocols
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-04 08:18:00 -07:00
Armin Kuster
8f045875fb apparmor: Add a python 3.10 compatability patch
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-26 07:23:18 -07:00
Armin Kuster
11a67b861a meta-security: Convert to new override syntax
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-01 08:47:08 -07:00
Yi Zhao
cab0c7d343 apparmor: use its own initscript and service files
Use initscript and service files provided by apparmor.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2021-07-10 05:16:52 -07:00
Yi Zhao
366bd7026f apparmor: upgrade 3.0 -> 3.0.1
Drop backport patches:
  0001-apparmor-fix-manpage-order.patch
  0001-libapparmor-add-missing-include-for-socklen_t.patch
  0002-libapparmor-add-aa_features_new_from_file-to-public-.patch
  0003-libapparmor-add-_aa_asprintf-to-private-symbols.patch
  0001-aa_status-Fix-build-issue-with-musl.patch
  0001-parser-Makefile-dont-force-host-cpp-to-detect-reallo.patch

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2021-07-10 05:16:26 -07:00
Sekine Shigeki
46f7e7acbe smack: add 3 cves to allowlist
CVE-2014-0363, CVE-2014-0364, CVE-2016-10027 are not for smack of smack-team(https://github.com/smack-team/smack) but other project.

Signed-off-by: Sekine Shigeki <sekine.shigeki@fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-20 15:49:26 -07:00
Armin Kuster
44a345dbb1 Apparmor: fix multi config build issue.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-16 13:23:55 -07:00
Armin Kuster
725526e0ea apparmor: Inherit python3targetconfig
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-23 20:34:51 -08:00
Armin Kuster
11dd919372 apparmor: fix build for on musl
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:31 -07:00
Armin Kuster
b8c437bf70 apparmor: update to 3.0
skip ptest for now, on todo list for fix.
Runtime test pass

remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
2a7963df18 apparmor: fix build issue with ptest enabled.
minor spacing cleanup

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
f176756890 apparmor: exclude mips64, not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Zheng Ruoqin
376fad4de1 ccs-tools:Fix build error when enable multilib.
ERROR: lib32-ccs-tools-1.8.4-r0 do_install: oe_runmake failed
ERROR: lib32-ccs-tools-1.8.4-r0 do_install: Execution of
'/build-armv8/tmp/work/armv7ahf-neon-mllib32-linux-gnueabi/lib32-ccs-tools/1.8.4-r0/temp/run.do_install.22368'
failed with exit code 1:
make: *** No rule to make target 'install'.  Stop.
WARNING: exit code 1 from a shell command.

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14 19:44:48 +00:00
Alexander Kanavin
3018714159 apparmor: pull in coreutils/findutils only when not using systemd as init manager
The utilities from those packages (xargs, comm) are only used in sysvinit
scripts, and so there is no need to pull them in when systemd is in use.
Both are gpl3 licensed, so this is beneficial for builds where gpl3 is not
allowed.

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-19 16:03:23 -07:00
Jan Luebbe
f1ca0f9117 apparmor: update to 2.13.4
Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-04-07 11:50:02 -07:00
Jan Luebbe
e45b54998c apparmor: fix wrong executable permission on service file
This avoids "systemd[1]: Configuration file
/lib/systemd/system/apparmor.service is marked executable. Please remove
executable permission bits. Proceeding anyway." on boot.

Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-04-07 11:49:54 -07:00
Armin Kuster
0d8cee5029 apparmor: update to tip
fixes Python3.8 configure issues

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-17 19:13:30 -08:00
Armin Kuster
197d3588b6 Apparmor: fix some runtime depends
missing xargs and comm

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-23 19:53:31 -08:00
Armin Kuster
41506052f6 smack-test: add feature check for smack
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
980bdff22e smack: add distro check
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
2e5662214d apparmor: add distro check
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Ming Liu
fa800e5261 meta: inherit features_check instead of distro_features_check
distro_features_check has been deprecated in OE.

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Armin Kuster
27ddb45554 apparmor: ptest fail to build on arm
exclude arm and aarch64 ptest tasks

[v2&3]

Sent before committing.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-17 13:29:07 -07:00
Armin Kuster
5d049e7ef8 apparmor: fix systemd support so it works
[Yocto # 13568]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-16 10:29:21 -07:00
Alexander Kanavin
400eade386 apparmor: make bash dependency optional
Bash is only needed by one not particularly important script,
so not requiring bash is a useful option for builds that
cannot have gpl3 components.

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-13 13:22:08 -07:00
Alexander Kanavin
e2612dd58d apparmor: add PRIVATE_LIBS for ptest package
Otherwise, the following occurs:
ERROR: apparmor-2.13.3-r0 do_package: apparmor: Multiple shlib providers for libapparmor.so.1: apparmor, apparmor-ptest (used by files: /home/alexander/development/poky/build-metaoe/tmp/work/core2-32-poky-linux/apparmor/2.13.3-r0/packages-split/apparmor/usr/lib/perl5/vendor_perl/5.30.0/i686-linux/auto/LibAppArmor/LibAppArmor.so)
ERROR: apparmor-2.13.3-r0 do_package: apparmor: Multiple shlib providers for libapparmor.so.1: apparmor, apparmor-ptest (used by files: /home/alexander/development/poky/build-metaoe/tmp/work/core2-32-poky-linux/apparmor/2.13.3-r0/packages-split/apparmor/usr/lib/python3.7/site-packages/LibAppArmor/_LibAppArmor.cpython-37m-i686-linux-gnu.so)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-13 13:22:00 -07:00