525 Commits

Author SHA1 Message Date
Jonatan Pålsson cf423c05bf sssd: Add missing files to SYSTEMD_SERVICE
These files are installed when the ssh or curl PACKAGECONFIGs are enabled.

Fixes the following error:

    ERROR: sssd-1.16.4-r0 do_package: QA Issue: sssd: Files/directories were
      installed but not shipped in any package:
        /lib/systemd/system/sssd-kcm.socket
        /lib/systemd/system/sssd-kcm.service
        /lib/systemd/system/sssd-ssh.socket
        /lib/systemd/system/sssd-ssh.service

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 52e3654d34 sssd: Add sudo PACKAGECONFIG
sudo was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-sudo is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 79d9fc23e2 sssd: Add autofs PACKAGECONFIG
autofs was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-autofs is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson 70a4908a97 sssd: Sort PACKAGECONFIG entries
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 5b82f67c48 buck-security: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 7beb91332f checksecurity: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster a9e3b04576 checksec: move to recipe-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster e4a2dd0b4a clamav: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster d2c383fa63 fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster 4229f5025e libseccomp: update to 2.4.3
dropped patch now included in update

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Armin Kuster 96737082ad sssd: python2 not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson 6eaee464bf sssd: DEPEND on nss if nothing else is chosen
sssd will attempt to build against nss if no crypto is selected. If a
bbappend sets PACKAGECONFIG = <list without nss or crypto>, the
appropriate DEPEND is not established.

Fixes the following configure error:

    ... snip ...
    | checking for NSS... configure: error: Package requirements (nss) were not met:
    |
    | No package 'nss' found
    |
    | Consider adjusting the PKG_CONFIG_PATH environment variable if you
    | installed software in a non-standard prefix.
    |
    | Alternatively, you may set the environment variables NSS_CFLAGS
    | and NSS_LIBS to avoid the need to call pkg-config.
    | See the pkg-config man page for more details.
    |
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson 1c22721eae sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson a509e21902 sssd: Add PACKAGECONFIG for python2
Fixes the following build error:

    .. snip ..
    | checking for python2... no
    | checking for python3... (cached) python3.8
    | configure: error:
    | The program python2 was not found in search path.
    | Please ensure that it is installed and its directory is included in the search
    | path. It is required for building python2 bindings. If you do not want to build
    | them please use argument --without-python2-bindings when running configure.
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:12:59 -07:00
Kai Kang 4375507f39 sssd: fix for ldblibdir and systemd etc
Fix sssd issue for ldblibdir, systemd, pam etc.

* fix ldblibdir which is not calculated right for cross compile
* create directory /var/log/sssd which is required by sssd daemon
* disable building python2 binding
* fix pam module path
* update systemd configure options and service files

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-05 08:06:51 -08:00
Armin Kuster 17b0f42647 secuirty*-image: remove dead var and minor cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 290b4bbf8c clamav-native: missed bison fix
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 73cb9a32dc clamav: add bison-native to depend
fixes build issue:
clamav/0.101.5-r0/git/config/ylwrap: line 176: yacc: command not found

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster 2a91f5cc62 google-authenticator-libpam: install module in pam location
pam_google_authenticator.so was being installed where pam could not find
it. Move it where the rest of the pam modules site.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:49:20 -08:00
Armin Kuster 238b8936e6 python3-fail2ban: add 2-3 conversion changes
Had to use the fail2ban-2.3 program to create py3 code
Add it as a patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:48:43 -08:00
Armin Kuster 2df5bbcf17 bastille: convert to py3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-10 19:13:52 -08:00
Armin Kuster 2732ab1467 ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-02 08:38:43 -08:00
Armin Kuster 037adba72e buck-security: fix rdebends and minor style cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster 3e9b32c714 checksecurity: fix runtime issues
add some missing perl modules

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Pierre-Jean Texier via Lists.Yoctoproject.Org 4c98f16973 google-authenticator-libpam: upgrade 1.07 -> 1.08
See changelog: https://github.com/google/google-authenticator-libpam/releases/tag/1.08

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster b02f3fae9d python3-fail2ban: update to latest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:57 -08:00
Armin Kuster fa8d29bffc sssd: drop py2 support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:20 -08:00
Armin Kuster b72cc7f87c fail2ban: fix runtime error
use success/failure calls in initd/function

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-05 16:09:44 -08:00
Armin Kuster 912ead8099 clamav: update to 0.101.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-03 11:54:58 -08:00
Armin Kuster 6b42f1c033 google-authenticator-libpam: update to 1.07
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster 4786213cab python3-fail2ban: include python-fail2ban.inc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster 36ebd09b06 python-fail2ban: Drop python2 package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Yi Zhao 2c2161fbc2 libseccomp: upgrade 2.4.1 -> 2.4.2
Backport a patch to fix ptest build failure on arm64.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-16 20:51:00 -08:00
Ming Liu fa800e5261 meta: inherit features_check instead of distro_features_check
distro_features_check has been deprecated in OE.

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson 484d13bc59 clamav: add tmpfiles.d config
This is needed to ensure freshclam's /var/log directory and file are
created when using systemd.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson b111206c4c checksecurity: use more portable find args
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Armin Kuster c55721b15e checksec: add missing rdepends to readelf
update test to check for depends

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-14 22:45:18 -07:00
Scott Ellis 46549c0ea5 ncrack: update to tip
LIC_FILES_CHKSUM changed do to the date bumped to 2018 to 2019.

The license is the same as nmap and the nmap recipe in meta-openembedded
has that beginline/endline grab stuff.

Went for consistency as ncrack is an nmap project.

Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-29 16:13:30 -07:00
Armin Kuster 546aca7e8a packagegroup-core-security: update package name
Also remove tpm packagegroup reference

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00
Armin Kuster 0d7ae67b0f packagegroup-core-security-ptest: only included if ptest is enabled
update python package names

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00
Stefan Agner 2153c59b42 libseccomp: build static library always
Always build static library. This is required e.g. for runc from
meta-virtualization in its default configuration.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Armin Kuster bf5dbd0313 python-scapy: drop py2 package
fixup run-ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Yuan Chao 30ea7a89dc checksec: upgrade 1.11.1 -> 2.1.0
Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:50 -07:00
Yuan Chao c6c9dd2e06 python-scapy: upgrade 2.4.2 -> 2.4.3
License file changed from bin/scapy to LICENSE

Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:35 -07:00
Adrian Bunk 7ce3c3368a xmlsec1: Remove, moved to meta-oe
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com 10ac9f8bff ecryptfs-utils: fix race condition in do_install
The rootsbindir is a self-defined directory. The install-rootsbinPROGRAMS
is actually treated as part of install-data instead of install-exec.

Do making install-exec-am depend on it actually results in the following
Makefile contents.

  install-data-am: install-rootsbinPROGRAMS
  install-exec-am: install-binPROGRAMS install-binSCRIPTS
          @$(NORMAL_INSTALL)
          $(MAKE) $(AM_MAKEFLAGS) install-exec-hook
  install-exec-hook:      install-rootsbinPROGRAMS

And this results in race condition as two install commands of the same
file running at the same time. Error message is like below.

  TOPDIR/tmp-glibc/hosttools/install: cannot create regular file 'TOPDIR/tmp-glibc/work/aarch64-wrs-linux/ecryptfs-utils/111-r0/image/sbin/mount.ecryptfs': File exists

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com bcbd10be87 ecryptfs-utils: remove openssl PACKAGECONFIG
ecryptfs-utils does not build with openssl1.1.

Previously this openssl PACKAGECONFIG is disabled by default, so
we are not getting build failures by default. But if we enable it,
we get do_compile failure.

This package is from ubuntu source, and the one ubuntu ships does not
depend on openssl. The development of this package has stopped for about
3 years. I don't see it will fix the build offically.

So remove this PACKAGECONFIG and use '--disable-openssl' directly.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:48 -07:00
Yi Zhao 26e306b9d2 xmlsec1: upgrade 1.2.27 -> 1.2.28
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-11 20:16:16 -07:00
Armin Kuster 265d27f3d2 keyutils: remove from meta-security
now in meta-oe

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster 3f253ddab8 clamav: minor recipe cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00