mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-07-16 03:47:21 +00:00
Code Issues Projects Releases Wiki Activity
544 Commits 40 Branches 0 Tags
mut
Commit Graph

544 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrii Bordunov via Openembedded-core 7c08edc7f5 cve-report.bbclass: add class 
Implements "report_cve" and "report_patched" tasks.

"report_patched" prepares image manifest with patched CVE info.
"report_cve" runs cvert-* scripts to generate kernel and package CVE reports.

You can configure it to set report filenames, reuse NVD feeds,
stop after manifest generation and ignore specific classes,
like native, nativesdk, etc.

Signed-off-by: grygorii tertychnyi <gtertych@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:33 -07:00
Andrii Bordunov via Openembedded-core 0fc645a946 cvert-kernel - generate CVE report for the Linux kernel 
NVD entries for the Linux kernel are almost always outdated.
For example, https://nvd.nist.gov/vuln/detail/CVE-2018-1065
is shown as matched for "versions up to (including) 4.15.7",
however the patch 57ebd808a97d has been back ported for 4.14.

By default, it checks NVD Resource entries for the patch
URLs and looks for the commits in the local GIT tree.

Additionaly ("--resource") it checks other resources, that
may have up-to-date CVE data. You can combine resources and
decide which one you want to be based on.

Signed-off-by: grygorii tertychnyi <gtertych@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:33 -07:00
Andrii Bordunov via Openembedded-core fbc9b46075 cve-report: add scripts to generate CVE reports 
cvert-foss - generate CVE report for the list of packages.
  Analyze the whole image manifest to align with the complex
  CPE configurations.

cvert-update - update NVD feeds and store CVE structues dump.
  CVE dump is a pickled representation of the cve_struct dictionary.

cvert.py - python library used by cvert-* scripts.
  NVD JSON Vulnerability Feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED

Usage examples:

  o Download CVE feeds to "nvdfeed" directory
    % cvert-update nvdfeed
  o Update CVE feeds and store a dump in a file
    % cvert-update --store cvedump nvdfeed
  o Generate a CVE report
    % cvert-foss --feed-dir nvdfeed --output report-foss.txt cve-manifest
  o (faster) Use dump file to generate a CVE report
    % cvert-foss --restore cvedump --output report-foss.txt cve-manifest
  o Generate a full report
    % cvert-foss --restore cvedump --show-description --show-reference \
                 --output report-foss-full.txt cve-manifest

Manifest example:

  bash,4.2,CVE-2014-7187
  python,2.7.35,
  python,3.5.5,CVE-2017-17522 CVE-2018-1061

Report example:

    patched |  7.5 | CVE-2018-1061      | python | 3.5.5
    patched | 10.0 | CVE-2014-7187      | bash | 4.2
    patched |  8.8 | CVE-2017-17522     | python | 3.5.5
  unpatched | 10.0 | CVE-2014-6271      | bash | 4.2
  unpatched | 10.0 | CVE-2014-6277      | bash | 4.2
  unpatched | 10.0 | CVE-2014-6278      | bash | 4.2
  unpatched | 10.0 | CVE-2014-7169      | bash | 4.2
  unpatched | 10.0 | CVE-2014-7186      | bash | 4.2
  unpatched |  4.6 | CVE-2012-3410      | bash | 4.2
  unpatched |  8.4 | CVE-2016-7543      | bash | 4.2
  unpatched |  5.0 | CVE-2010-3492      | python | 2.7.35
  unpatched |  5.3 | CVE-2016-1494      | python | 2.7.35
  unpatched |  6.5 | CVE-2017-18207     | python | 3.5.5
  unpatched |  6.5 | CVE-2017-18207     | python | 2.7.35
  unpatched |  7.1 | CVE-2013-7338      | python | 2.7.35
  unpatched |  7.5 | CVE-2018-1060      | python | 3.5.5
  unpatched |  8.8 | CVE-2017-17522     | python | 2.7.35

Signed-off-by: grygorii tertychnyi <gtertych@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:33 -07:00
Armin Kuster de00a8fd41 image: add image for testing 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 0acb5d2c7d runtime qa: moderize ima test 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster f5e9ba656e initramfs: clean up to pull in packages. 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 1bbd9d70f7 data: remove policies 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 17acb4ec73 policy: add ima appraise all policy 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster cc754f8e8f ima_policy_simple: add another sample policy 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster e6162d49f9 ima-policy-hashed: add new recipe 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster e11a6b2f81 base-files: add appending to automount securityfs 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster d0aa534da8 linux: update bbappend 
remove untested code

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 40788be7b2 ima.cfg: update to 5.0 kernel 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 8ccf6cafba ima-evm-utils: cleanup and update to tip 
update to tip
backported patches to fix build issues.
fix native support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 982352e810 README: update 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster e9e893b945 layer.conf: add LAYERSERIES_COMPAT 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:58:11 -07:00
Armin Kuster 9579271054 meta-integrity: port over from meta-intel-iot-security 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-26 21:57:55 -07:00
leimaohui 479d9cc23a python3-fail2ban: Fix build error of xrange. 
NameError: name 'xrange' is not defined

Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-21 08:18:36 -07:00
Armin Kuster 56d6256c83 checksec: add runtime test 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-21 08:18:36 -07:00
Armin Kuster 28629fe8a4 keyutils: fix library install path 
[v2]
fix multilib support
Als add native support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-21 08:18:36 -07:00
Armin Kuster 7b9206d346 checksec: update to 1.11.1 
* checksec.sh: Updated to 1.11.1
* checksec.sh: resolved issues with readelf
* checksec.sh: Added docker images for testing
* checksec.sh: Added armhf and aarch64 libc locations
* checksec.sh: Replace FS_COUNT with fgrep
* checksec.sh: Fixed symbols count in csv
* checksec.sh: Fixed RW-RPATH and RW-RUNPATH
* checksec.sh: Added stack canaries generated by intel compiler
* checksec.sh: Mute stat errors for non-existent directories
* checksec.sh: Removed invalid json structures and duplicate kernel checks
* checksec.sh: fixed spaces in -d option
* checksec.sh: Added stack-protector-string check
* checksec.sh: Add arm64 specific kernel checks
* checksec.sh: Add REFCOUNT_FULL to kernel tests
* checksec.sh: Remove OSX support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-21 08:18:36 -07:00
Armin Kuster 9f5cc2a7eb smack: kernel fragment update 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-12 11:10:44 -07:00
Armin Kuster 6e3c025a5b oe-selftest: add running cve checker 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-12 11:10:36 -07:00
Alexander Kanavin 462d76700a apparmor: fetch from git 
Tarballs from archive.ubuntu.com can and do disappear (similar to archive.debian.org).

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-12 10:49:36 -07:00
Armin Kuster 34cb20fe5c libseccomp: update to 2.4.1 
bug fix release.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 20:05:47 -07:00
Armin Kuster 78d7a2ef26 libldb: add earlier version 
This version does not have a dependacy on samba

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 20:05:32 -07:00
Armin Kuster f524ba9665 samhain: add more tests and fix ret checks 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 17:45:13 -07:00
Armin Kuster 8eee8727cb smack-test: add smack tests from meta-intel-iot-security 
ported over smack tests

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 17:45:13 -07:00
Armin Kuster 5d37937f2e smack: move patch to smack dir 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 17:44:59 -07:00
Armin Kuster f67e1bc01d apparmor: add a few more runtime 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 17:44:59 -07:00
Armin Kuster f506138eb5 apparmor: fix fragment for 5.0 kernel 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-09 17:44:59 -07:00
Yi Zhao eaa616a2e2 meta-tpm/README: update 
Add more description

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-01 15:53:40 -07:00
Yi Zhao e3f6970b09 meta-tpm/conf/layer.conf: update layer dependencies 
Add openembedded-layer to layer dependencies.

Fix the following build errors:

ERROR: Required build target 'tpm2-pkcs11' has no buildable providers.
Missing or unbuildable dependency chain was: ['tpm2-pkcs11', 'dstat']

ERROR: Required build target 'cryptsetup-tpm-incubator' has no buildable providers.
Missing or unbuildable dependency chain was: ['cryptsetup-tpm-incubator', 'libdevmapper']

ERROR: Required build target 'tpm2-totp' has no buildable providers.
Missing or unbuildable dependency chain was: ['tpm2-totp', 'qrencode']

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-05-01 15:53:32 -07:00
Armin Kuster 5959e4f4bf clamav-native: fix new build issue 
re-arch the reciped to build properly.

Fixed /var/lib/clamav dir issue

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-14 10:54:20 -07:00
Armin Kuster ab3c84c4d3 clamav: add clamav-cvd package for cvd db 
Add native package to support creating a mirror
of the clamav cvd and supply it in a new package.

Provide a INSTALL_CLAMAV_CVD flag to bypass this creation

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-14 10:54:07 -07:00
Armin Kuster 3b88d3d9ca clamav: runtime fix local routing 
This addes the localhost to resolve.conf to fix:

ERROR: Can't get information about database.clamav.net: Temporary failure in name resolution
ERROR: Can't download main.cvd from database.clamav.net
Giving up on database.clamav.net...

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-13 10:31:20 -07:00
Armin Kuster 361aa8c562 libldb: add waf-cross-answeres 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-13 10:31:20 -07:00
Armin Kuster 67369e1428 clamav: fix llvm reference version 
llvm8.0 does not exist. dropped the version part.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-13 10:31:20 -07:00
Armin Kuster 109b8260bf clamav runtime: add resolve.conf support 
and ping test too

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-13 10:31:11 -07:00
Armin Kuster 8a1f54a246 libmspack: update to 0.10.1 
For details see: https://github.com/kyz/libmspack/blob/master/libmspack/ChangeLog

change compression to match that now being used from source

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-07 05:13:33 +05:30
Armin Kuster 98750e8933 ccs-tools: move to reciped-mac 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-07 05:12:43 +05:30
Armin Kuster 63af29ba48 layer.conf: Add warrior to compatible release series 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-07 05:10:15 +05:30
Armin Kuster cb6d1c85ee linux-yocto/5.0: add apparmor fragments 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-01 19:21:21 -07:00
Armin Kuster cb412637a2 linux-yocto: make bbappend version neutral 
update apparmor configs

[v2]
Just update configs.

leave versions intact.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-04-01 19:21:06 -07:00
Armin Kuster 5b8e4cb21b apparmor: add basic runtime test 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 11:57:11 -07:00
Armin Kuster 5dcf7ca44e apparmor: update to 2.13.2 
Drop patch included in update:
tool-paths.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 11:57:02 -07:00
Armin Kuster 1460d9b86d reorg ids: move ids recipes to recipes-ids 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 10:37:09 -07:00
Armin Kuster 75e609f7b1 reorg: move mac recipes to recipes-mac 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 10:37:09 -07:00
Armin Kuster 00f00d2897 clamav: add basic runtime tests 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 10:37:09 -07:00
Armin Kuster 6d3aa03272 clamav: drop llvm version setting 
There is only one llvm and its in core so
drop allowing it to be overwritten.
We can hardcode it now.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-03-31 10:37:09 -07:00