mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-07-15 15:37:18 +00:00
Code Issues Projects Releases Wiki Activity
1,450 Commits 40 Branches 0 Tags
nanbield
Commit Graph

73 Commits

Author SHA1 Message Date
Wurm, Stephan a94674c5bc dm-verity-image-initramfs: Allow compressed image types 
Using <DM_VERITY_IMAGE_TYPE> in the depends variable does not work for
compressed image types like squashfs-zst, as the resulting task
dependency still contains the incompatible dash. Replacing the dash by
an underscore resolves this issue.

Signed-off-by: Stephan Wurm <stephan.wurm@a-eberle.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-08-06 11:31:18 -04:00
Armin Kuster e4318a3c5a packagegroup-core-security: only include firejail x86-64 and arch64 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-07-31 06:18:52 -04:00
Armin Kuster cfe7335568 qemu: move qemu setting to image and out of layer.conf 
I suspect its better form to have these in the image definition.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-07-31 06:18:52 -04:00
Armin Kuster 515dd792ba packagegroup-core-security: add os-release 
Exclude openscap and scap-security-guide if musl

Fix RDEPENDS list to include compliance packages.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-06-25 15:05:28 -04:00
Paul Gortmaker 521e7b040a dm-verity: hook separate hash into initramfs framework 
The prior commits create the separate hash so now it is time to update
the initramfs framework so that veritysetup, which is responsible for
binding the data and hash, is aware of when separate hash is in use,
and can react accordingly.

The added code follows the existing appended hash code style, but is
considerably smaller because it doesn't have the large case statement
that supports all possible identification schemes (label, UUID, ...).

With the root hash split in two to create the respective partition
UUIDs, we know exactly how to identify it, and the UUIDs used.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-06-25 15:05:28 -04:00
Armin Kuster 6ae25c7673 packagegroup-core-security: add compliance pkg group 
Signed-off-by: Armin Kuster <akuster808@gmail.com>

---
v2]
Missed to include trailing \
 2023-06-20 11:07:20 -04:00
Kevin Hao c50757b2f1 dmverity: Suppress the realpath errors 
If we use a non PARTUUID root parameter, we would always get a error
like below:
  realpath: /dev/disk/by-partuuid//dev/mmcblk0p2: No such file or directory

This seems pretty confusion and it also seems no need to emit this kind
of error when we are waiting for the root device. So suppress all the
realpath errors.

Signed-off-by: Kevin Hao <kexin.hao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-06-11 10:40:33 -04:00
Armin Kuster 4ed311eaf7 packagegroup-core-security: refactor the inclusion of krill 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2023-03-22 08:02:50 -04:00
John Edward Broadbent 571af37e9c meta-security: Add recipe for Glome 
Generic Low Overhead Message Exchange (GLOME) is a protocol providing
secure authentication and authorization for low dependency environments.

Signed-off-by: John Edward Broadbent <jebr@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-12 08:32:51 -07:00
Armin Kuster 5f530ba5ab packagegroup-core-security: add pkg to grp 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-12 08:32:51 -07:00
Armin Kuster c352530c13 packagegroup-core-security: add space for appends 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-06 08:55:49 -07:00
Armin Kuster 2a2d650ee0 packagegroup-core-security: remove krill for some archs 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-02 13:45:26 -07:00
Armin Kuster d8d3824d2d packagegroup-core-security: add chipsec pkg to grp 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-02 13:45:26 -07:00
Armin Kuster c48c6e5881 packagegroup-core-security: add krill to pkg grps 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-08-02 13:45:26 -07:00
Armin Kuster ac0a4ea0f8 packagegroup-core-security.bb: add bubblewrap to pkg grp 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-07-30 14:11:27 -07:00
Armin Kuster f453866cf6 security-build-image: add lkrg-module to build image 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-23 18:47:59 -07:00
Armin Kuster a68a46ded9 packagegroup-core-security: skip mips firejail 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-23 18:47:59 -07:00
Armin Kuster 123c59c313 security-test-image: add firejail and aide test suites 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-23 18:47:59 -07:00
Armin Kuster 6cdb369591 packagegroup-core-security: add firejail 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-23 18:47:59 -07:00
Armin Kuster 6c77d06b84 security-test-image: auto include layers if present. 
This is to simplify tesing to build one image and include pkgs depending on the
layers included in the BBLAYERS.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-18 06:48:22 -07:00
Armin Kuster db2ebfc0d3 packagegroup-core-security: drop sssd 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-18 06:48:22 -07:00
Armin Kuster 8c6fe006a1 packagegroup-core-security: don't include aprwatch for musl 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-07 16:58:24 -07:00
Armin Kuster 5bdb7a35c1 packagegroup-core-security: drop arpwatch for riscv from pkg grp 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-07 16:58:24 -07:00
Armin Kuster 982ff6fb97 packagegroup-core-security: add arpwatch and chkrootkit to pkg grp 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-06-07 16:58:24 -07:00
Armin Kuster bc59937b54 packagegroup-core-security.bb: fix suricata inclusion 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-05-14 10:51:32 -07:00
Armin Kuster 55839bcd20 packagegroup-core-security: remove pkgs 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2022-05-14 10:51:32 -07:00
Armin Kuster e740a30c10 libest: does not build with openssl 3.x 
blacklist for now. Remove from pkg grp

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-12-25 11:29:31 -08:00
Armin Kuster e5e54135da opendnssec: blacklist do to ldns being blacklisted 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-10-24 19:54:00 -07:00
Christer Fletcher 650e6d6d4b dmverity: Make use of DATA_BLOCK_SIZE variable in initrdscript. 
DATA_BLOCK_SIZE variable was set in dm-verity-img.bbclass at build
time but the initrdscript was not updated to pass the DATA_BLOCK_SIZE
to the veritysetup. Now the functionality is complete.

Signed-off-by: Paulo Neves <paulo.neves1@inter.ikea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-09-28 16:18:41 -07:00
Armin Kuster c885d399cd packagegroup-core-security.bb: only include suricat-ptest if rust is included 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-08-01 08:47:08 -07:00
Armin Kuster 11a67b861a meta-security: Convert to new override syntax 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-08-01 08:47:08 -07:00
Armin Kuster f447658731 packagegroup-core-security.bb: fix suricat-ptest inclusion 
drop libseccomp ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-07-28 18:21:25 -07:00
Armin Kuster be53d1a467 initramfs-framework: rename files dir 
Fixes:
ERROR: initramfs-framework-1.0-r4 do_fetch: Fetcher failure for URL: 'file://dmverity'. Unable to fetch URL from any source.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-29 09:31:13 -07:00
Armin Kuster 8f313d951c packagegroup-core-security: add sshguard 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-29 09:31:13 -07:00
Armin Kuster 54186fc738 initramfs-framework: fix typo in conditional 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-29 09:31:13 -07:00
Armin Kuster 0c26950b0d packagegroup-core-security: drop python3-scapy 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-05 19:25:24 +00:00
Armin Kuster f40fdc7e6d initramfs-framework: fix YCL issue. 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-05 19:25:24 +00:00
Armin Kuster a1d5476acc busybox: drop as libsecomp is in core 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-05 19:25:23 +00:00
Armin Kuster e1f0699492 packagegroup-core-security: exclude ossec-hids from musl 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-06-05 19:25:17 +00:00
Armin Kuster ab239f1497 packagegroup-core-security: add clamav-daemon 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-05-16 13:23:55 -07:00
Armin Kuster 31e5b3e08f packagegroup-core-security: add aide and ossec 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-05-16 13:23:55 -07:00
Armin Kuster 06101dd3da packagegroup-core-security: fix typo for mips 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-05-16 13:23:55 -07:00
Armin Kuster 7db47965a2 tripwire: Blacklist pkg, upstream seems abandond 
Last update was 2018. Does not build with gcc11.
There are other actively maintained IDS options.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-05-16 13:23:55 -07:00
Armin Kuster 881d441f71 packagegroup-core-security: exclude apparmor in mips64 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-04-19 06:56:18 -07:00
Armin Kuster 44d51ebff5 packagegroup-core-security: drop clamav-cvd 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2021-04-02 08:21:34 -07:00
Armin Kuster 496a734c14 packagegroup-core-security: remove clamav from musl image 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-10-10 16:21:48 -07:00
Armin Kuster 8bab022533 packagegroup-core-security: apparmor 3.0 ptest does not build 
for now skip apparmor ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-10-09 07:02:01 -07:00
Armin Kuster 21489a2942 security-test-image: tweak to get more tests to runn 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-10-09 07:02:01 -07:00
Naveen Saini e23767fc72 initramfs-framework/dmverity: add retry loop for slow boot devices 
Detection of USB devices by the kernel is slow enough. We need to
keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>)
and sleep between each attempt (default: one second, rootdelay=<seconds>).

Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4

Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-10-09 07:01:47 -07:00
Armin Kuster ab56b1df52 packagegroup-core-security-ptest: remove 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-10-01 06:22:07 -07:00