512 Commits

Author SHA1 Message Date
Jonatan Pålsson
a509e21902 sssd: Add PACKAGECONFIG for python2
Fixes the following build error:

    .. snip ..
    | checking for python2... no
    | checking for python3... (cached) python3.8
    | configure: error:
    | The program python2 was not found in search path.
    | Please ensure that it is installed and its directory is included in the search
    | path. It is required for building python2 bindings. If you do not want to build
    | them please use argument --without-python2-bindings when running configure.
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:12:59 -07:00
Kai Kang
4375507f39 sssd: fix for ldblibdir and systemd etc
Fix sssd issue for ldblibdir, systemd, pam etc.

* fix ldblibdir which is not calculated right for cross compile
* create directory /var/log/sssd which is required by sssd daemon
* disable building python2 binding
* fix pam module path
* update systemd configure options and service files

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-05 08:06:51 -08:00
Armin Kuster
17b0f42647 secuirty*-image: remove dead var and minor cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
290b4bbf8c clamav-native: missed bison fix
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
73cb9a32dc clamav: add bison-native to depend
fixes build issue:
clamav/0.101.5-r0/git/config/ylwrap: line 176: yacc: command not found

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
2a91f5cc62 google-authenticator-libpam: install module in pam location
pam_google_authenticator.so was being installed where pam could not find
it. Move it where the rest of the pam modules site.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:49:20 -08:00
Armin Kuster
238b8936e6 python3-fail2ban: add 2-3 conversion changes
Had to use the fail2ban-2.3 program to create py3 code
Add it as a patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:48:43 -08:00
Armin Kuster
2df5bbcf17 bastille: convert to py3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-10 19:13:52 -08:00
Armin Kuster
2732ab1467 ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-02 08:38:43 -08:00
Armin Kuster
037adba72e buck-security: fix rdebends and minor style cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster
3e9b32c714 checksecurity: fix runtime issues
add some missing perl modules

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Pierre-Jean Texier via Lists.Yoctoproject.Org
4c98f16973 google-authenticator-libpam: upgrade 1.07 -> 1.08
See changelog: https://github.com/google/google-authenticator-libpam/releases/tag/1.08

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster
b02f3fae9d python3-fail2ban: update to latest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:57 -08:00
Armin Kuster
fa8d29bffc sssd: drop py2 support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:20 -08:00
Armin Kuster
b72cc7f87c fail2ban: fix runtime error
use success/failure calls in initd/function

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-05 16:09:44 -08:00
Armin Kuster
912ead8099 clamav: update to 0.101.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-03 11:54:58 -08:00
Armin Kuster
6b42f1c033 google-authenticator-libpam: update to 1.07
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
4786213cab python3-fail2ban: include python-fail2ban.inc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
36ebd09b06 python-fail2ban: Drop python2 package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Yi Zhao
2c2161fbc2 libseccomp: upgrade 2.4.1 -> 2.4.2
Backport a patch to fix ptest build failure on arm64.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-16 20:51:00 -08:00
Ming Liu
fa800e5261 meta: inherit features_check instead of distro_features_check
distro_features_check has been deprecated in OE.

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson
484d13bc59 clamav: add tmpfiles.d config
This is needed to ensure freshclam's /var/log directory and file are
created when using systemd.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson
b111206c4c checksecurity: use more portable find args
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Armin Kuster
c55721b15e checksec: add missing rdepends to readelf
update test to check for depends

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-14 22:45:18 -07:00
Scott Ellis
46549c0ea5 ncrack: update to tip
LIC_FILES_CHKSUM changed do to the date bumped to 2018 to 2019.

The license is the same as nmap and the nmap recipe in meta-openembedded
has that beginline/endline grab stuff.

Went for consistency as ncrack is an nmap project.

Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-29 16:13:30 -07:00
Armin Kuster
546aca7e8a packagegroup-core-security: update package name
Also remove tpm packagegroup reference

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00
Armin Kuster
0d7ae67b0f packagegroup-core-security-ptest: only included if ptest is enabled
update python package names

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00
Stefan Agner
2153c59b42 libseccomp: build static library always
Always build static library. This is required e.g. for runc from
meta-virtualization in its default configuration.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Armin Kuster
bf5dbd0313 python-scapy: drop py2 package
fixup run-ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Yuan Chao
30ea7a89dc checksec: upgrade 1.11.1 -> 2.1.0
Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:50 -07:00
Yuan Chao
c6c9dd2e06 python-scapy: upgrade 2.4.2 -> 2.4.3
License file changed from bin/scapy to LICENSE

Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:35 -07:00
Adrian Bunk
7ce3c3368a xmlsec1: Remove, moved to meta-oe
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com
10ac9f8bff ecryptfs-utils: fix race condition in do_install
The rootsbindir is a self-defined directory. The install-rootsbinPROGRAMS
is actually treated as part of install-data instead of install-exec.

Do making install-exec-am depend on it actually results in the following
Makefile contents.

  install-data-am: install-rootsbinPROGRAMS
  install-exec-am: install-binPROGRAMS install-binSCRIPTS
          @$(NORMAL_INSTALL)
          $(MAKE) $(AM_MAKEFLAGS) install-exec-hook
  install-exec-hook:      install-rootsbinPROGRAMS

And this results in race condition as two install commands of the same
file running at the same time. Error message is like below.

  TOPDIR/tmp-glibc/hosttools/install: cannot create regular file 'TOPDIR/tmp-glibc/work/aarch64-wrs-linux/ecryptfs-utils/111-r0/image/sbin/mount.ecryptfs': File exists

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com
bcbd10be87 ecryptfs-utils: remove openssl PACKAGECONFIG
ecryptfs-utils does not build with openssl1.1.

Previously this openssl PACKAGECONFIG is disabled by default, so
we are not getting build failures by default. But if we enable it,
we get do_compile failure.

This package is from ubuntu source, and the one ubuntu ships does not
depend on openssl. The development of this package has stopped for about
3 years. I don't see it will fix the build offically.

So remove this PACKAGECONFIG and use '--disable-openssl' directly.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:48 -07:00
Yi Zhao
26e306b9d2 xmlsec1: upgrade 1.2.27 -> 1.2.28
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-11 20:16:16 -07:00
Armin Kuster
265d27f3d2 keyutils: remove from meta-security
now in meta-oe

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster
3f253ddab8 clamav: minor recipe cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
37dc57c998 libmspack: update SRC_URI and package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
88350b1267 test-image: add a few more packages to image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
2098981e0c test-image: add packagegroup-core-security-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
55ff4e2434 packagegroup-core-security: cleanup and remove ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
ee580bd011 security-test-image: add a testing image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Zang Ruochen
c28b72e91d python3-scapy: solved the conflict with python-scapy
-Rename the following file to resolve the conflict with python-scapy:
	Rename /usr/bin/UTscapy to /usr/bin/UTscapy3
	Rename /usr/bin/scapy to /usr/bin/scapy3

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:35 -07:00
Zang Ruochen
470271aea7 python-scapy: solved the conflict with python3-scapy
-Rename the following file to resolve the conflict with python3-scapy:
	Rename /usr/bin/UTscapy to /usr/bin/UTscapy2
	Rename /usr/bin/scapy to /usr/bin/scapy2

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:35 -07:00
Zang Ruochen
b1e379ee5c python-scapy: Remove redundant sed operations
-Remove redundant sed operations.

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:27 -07:00
Zang Ruochen
376d34368e bastille: solved the conflict with perl-module-text-wrap and base-files
-Remove the link to perl5 to resolve the conflict with perl-module-text-wrap.

-Remove the operation on /var/lock to resolve the conflict with base-files.

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:18 -07:00
leimaohui
479d9cc23a python3-fail2ban: Fix build error of xrange.
NameError: name 'xrange' is not defined

Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
28629fe8a4 keyutils: fix library install path
[v2]
fix multilib support
Als add native support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
7b9206d346 checksec: update to 1.11.1
* checksec.sh: Updated to 1.11.1
* checksec.sh: resolved issues with readelf
* checksec.sh: Added docker images for testing
* checksec.sh: Added armhf and aarch64 libc locations
* checksec.sh: Replace FS_COUNT with fgrep
* checksec.sh: Fixed symbols count in csv
* checksec.sh: Fixed RW-RPATH and RW-RUNPATH
* checksec.sh: Added stack canaries generated by intel compiler
* checksec.sh: Mute stat errors for non-existent directories
* checksec.sh: Removed invalid json structures and duplicate kernel checks
* checksec.sh: fixed spaces in -d option
* checksec.sh: Added stack-protector-string check
* checksec.sh: Add arm64 specific kernel checks
* checksec.sh: Add REFCOUNT_FULL to kernel tests
* checksec.sh: Remove OSX support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
34cb20fe5c libseccomp: update to 2.4.1
bug fix release.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-09 20:05:47 -07:00